US7475428B2 - Secure detection network system - Google Patents

Secure detection network system Download PDF

Info

Publication number
US7475428B2
US7475428B2 US10/600,738 US60073803A US7475428B2 US 7475428 B2 US7475428 B2 US 7475428B2 US 60073803 A US60073803 A US 60073803A US 7475428 B2 US7475428 B2 US 7475428B2
Authority
US
United States
Prior art keywords
node
nodes
remote
remote nodes
container
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US10/600,738
Other versions
US20040073808A1 (en
Inventor
Fred Hewitt Smith
Benjamin Hewitt Smith
Cynthia Smith
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Angel Secure Networks Inc
Original Assignee
Angel Secure Networks Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Angel Secure Networks Inc filed Critical Angel Secure Networks Inc
Priority to US10/600,738 priority Critical patent/US7475428B2/en
Publication of US20040073808A1 publication Critical patent/US20040073808A1/en
Assigned to ANGEL SECURE NETWORKS, INC. reassignment ANGEL SECURE NETWORKS, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: SMITH, BENJAMIN HEWITT, SMITH, CYNTHIA, SMITH, FRED HEWITT
Priority to US12/277,100 priority patent/US7930761B2/en
Application granted granted Critical
Publication of US7475428B2 publication Critical patent/US7475428B2/en
Priority to US13/088,824 priority patent/US8533855B2/en
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/313User authentication using a call-back technique via a telephone network
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/32User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/12Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Definitions

  • the inventive concepts relate to systems and methods for ensuring security of sensitive assets. More specifically, the present inventions relates to systems and methods that implement secure communications to ensure security of the sensitive assets.
  • Sensitech based in Beverly, Mass. (www.sensitech.com), provides solutions in the food and pharmaceuticals fields that are used for monitoring temperature and humidity for goods in-process, in-transit, in-storage, and on-display. So, temperature and humidity monitors can be placed in storage and transit containers to ensure desired conditions are maintained.
  • an “enemy” may employ any of a variety of strategies to defeat such a detection system. For instance, an enemy may attempt to shield the suspicious materials or activities from the detectors; defeat the communication interface between the detectors and the external system, so that the interface does not report evidence of suspicious materials or activities sensed by the detectors; disconnect the detectors from the interface; surreptitiously load a container that contains an atomic weapon, but that does not contain detecting devices, onto a container ship; overcome external systems so that they incorrectly report on the status of the detectors.
  • the difficult aspect of the environment is that the detecting devices and the communications interface will be in the hands of the potential enemy for some period of time, at least for the period of time necessary to load the container. Also, since the potential enemy is presumed capable of constructing an atomic weapon, the enemy must be presumed able to utilize other advanced technologies suitable for defeating the detecting devices and the interface.
  • a system and method for providing a secure detection network system includes a plurality of nodes, each node comprising a processor and storage means. Such nodes include a plurality of remote nodes, each remote node comprising a set of detector interfaces configured for coupling to a set of detectors disposed for detecting the presence of an illegal condition.
  • the illegal condition may include the presence of one or more suspicious materials, including chemical weapons, biological weapons, nuclear weapons, chemical agents, biological agents, radioactive materials, illegal drugs, explosive materials or devices, or shielding means.
  • the illegal condition may also include a suspicious activity, including an attempt to defeat a remote node or detector.
  • the remote nodes can be provided within a tamper resistant box, that could be coupled to a sensitive, for example.
  • Sensitive assets could include, for example, assets such as a shipping container, vehicle, human, event, room, area or building. Within the box may also be provided a set of detectors. The detectors are configured to detect the illegal condition, and could also detect an attempt to compromise the detector, remote node, or sensitive asset.
  • At least one server node To establish a secure network, and each node therein, at least one server node generates and distributes to each node an intelligent agent module and a set of node specific configuration files, selectively including software and data files.
  • the configuration files include information defining for that node a set of other nodes with which the node can communicate. This includes providing a different encryption means corresponding to each node in the set other nodes.
  • Installation of a node includes executing the downloaded to agent and configuration files. Once installation is complete, strobing of the encryption means (e.g., key pairs) between nodes can be included.
  • At least one monitor node can be provided to couple to and audit other nodes in the secure network, including the remote nodes.
  • This auditing function may include receiving signals indicating an illegal condition or tampering with a remote node.
  • a robot node could also be provided, as another form of monitor node, which could be hosted on a portable platform.
  • These nodes could include wired or wireless interfaces, as could the server nodes and the remote nodes.
  • the one or more termination events could include detecting tampering of one or more remote nodes.
  • Subnetworks may be formed from a set of remotes nodes, wherein each subnetwork could provide a portion of the communication path to the monitor node and server node for a given remote node.
  • orthogonal authentication could also be provided, such as by using independent biometric information about an individual.
  • FIG. 1 is a block diagram of a secure detection system network, in accordance with the present invention.
  • FIG. 2 is a block diagram of a portion of the block diagram of FIG. 1 , with a plurality of containers.
  • FIG. 3 is a block diagram of a portion of the block diagram of FIG. 1 , with a plurality of containers in a stacked configuration.
  • FIG. 4 is a block diagram of a massively scalable Secure Network, in accordance with the present invention.
  • a system and method in accordance with the present invention provide a secure network having interfaces to detectors configured to detect any of a number of undesired conditions. Such a system and method provide security for network nodes against attacks, whether intentional by an enemy or inadvertent by friendly forces. Such a system and method include a plurality of nodes configured to communicate in a highly secure and robust manner. Several of the nodes include or interface with one or more detectors, monitors, or sensing devices (collectively, “detectors”) configured to sense the presence or introduction of an “illegal condition”, such as suspicious materials or activities.
  • suspicious materials include any material of a nature such that, if detected, would present a reason to open a container and examine it.
  • Such materials could include drugs, nuclear, chemical, biological or other hazardous materials, devices, compositions, or agents, or any weapons or agents of mass destruction, including nuclear weapons, explosives, chemical weapons, and biological weapons, as well as shielding material that would shield radiation, explosives or biological weapons from detection.
  • Suspicious materials could also represent materials that were at variance with the materials that the shipper states are supposed to be in the container.
  • suspicious activities would involve detection of any activity such that, if detected, would represent a reason to open the container and examine it or to otherwise consider a formerly trusted asset as untrusted.
  • Suspicious activity could include electromagnetic radiation, sonar, or heat variations, or removal or tampering with a detector or remote node. For example, removing a detector or remote node from a container might be indicative of an attack on a detector, node or container.
  • the presence of human beings inside a container after the container had been closed and was ready for shipment would also constitute suspicious activities, or the presence of a human that has not been properly authenticated.
  • the Secure Network includes at least one server node that distributes intelligent agents (or agent modules) to devices, and any other software and data necessary to configure and enable the node.
  • Each agent module is specific to the device to which it is distributed.
  • a device properly configured with an agent module is referred to as a node.
  • the node includes information received from the server node that identifies other nodes with which the agent's node is to communicate.
  • Each pair of nodes that is configured to communicate will be configured with encryption means unique to that pair of nodes' communication, which may take the form of unique key pairs. These key pairs may be strobed to further enhance security.
  • the agent module installs any applications or software distributed from the server node to the agent's node.
  • the server node may also reinstall the network at any time, e.g., in response to loss of a node or a determination that a node has been compromised. Additionally, a monitor node can be included to audit a group of nodes.
  • authentication of the auditor is required.
  • the authentication could be provided, at least in part, using orthogonal authentication, i.e., at least two independent means of authentication.
  • a first means of authentication could be by entry of user ID and password.
  • a second means of authentication could be by biometric information (or bioinformatics), such as a palm, hand, finger print, retina, or face scan.
  • Orthogonal authentication is discussed in greater detail in Appendix B.
  • a wireless device or devices may be attached to or embedded in shipping containers.
  • the remote nodes may couple by wired or wireless means to various detectors configured, for example, to detect weapons of mass destruction.
  • the detectors can be located inside the container and distributed as needed to adequately perform their surveillance functions.
  • the detectors can be packaged with remote nodes or external to the remote nodes.
  • the remote nodes are queried by appropriate external monitor systems to determine if the nodes and detectors have sensed weapons of mass destruction or other contraband.
  • One issue to be confronted in such a scenario is that an enemy might attempt to sabotage or reverse engineer the nodes so that they falsely report a safe status, so that the container would pass query by authorities.
  • This scenario is referred to as the shipping container scenario.
  • wireless remote nodes may be attached to soldiers so that these nodes can be queried on the battlefield to determine whether a person is friend or foe.
  • soldiers might capture the soldiers or the equipment and reverse engineer the wireless remote node, thereby allowing the enemy to masquerade as a friend.
  • friendly forces might mistakenly consider a soldier on the battlefield who cannot be authenticated to be the enemy and open fire. This scenario is referred to as the soldier scenario.
  • wireless remote nodes may be attached to equipment such as tanks or airplanes. In such a case, the remote nodes can be queried on the battlefield to determine whether the vehicle is friend or foe. This scenario is referred to as the vehicle scenario.
  • wireless remote nodes may be attached to individuals so that the individuals can gain authorized access to a building or an event.
  • An issue to be confronted is that an enemy may capture an authorized individual, reverse engineer the remote node, and gain unauthorized admission. This scenario is referred to as the pass holder scenario.
  • the wireless remote node passes through the following stages:
  • stage (4) is the ability to detect in stage (4) if an enemy attack has occurred in stage (3). This goal could be achieved by providing in stage (4) a measure of the probability that an attack has or has not occurred in stage (3).
  • An additional goal in the soldier and vehicle scenarios is to positively identify an unknown person or vehicle as friend or foe. Table 1 shows, for each scenario, a set of secure stages and a corresponding set of attack detection approaches, as examples.
  • Each shipping container would contain one or more wireless remote nodes that is configured to communicate internally with one another and externally with other nodes.
  • the remote nodes would include an interface to facilitate coupling to various sensors disposed to detect the presence of illegal conditions within the container.
  • sensors could, for example, be embedded in or attached to the container, as could be the remote nodes.
  • the sensors could be configured to detect access to the container, whether authorized or unauthorized.
  • Illegal conditions could be the presence of any one or more of dangerous chemicals, biological agents or radioactive materials, explosives, drugs, or the like.
  • the shipping container will at various times be in facilities that are relatively secure, such as the manufacturing plant or a US Port or US controlled facility. At these times, the remote nodes can be securely provided with cryptographic materials via the Secure Network.
  • the wireless devices would detect an attack when they sensed prohibited substances or when an individual device sensed that it was being attacked.
  • Several remote nodes could also continually monitor one another inside the container. Adjacent containers could also monitor one another.
  • the soldier will have a wireless device connected to a body sensor.
  • An attack will be sensed when reports from the body sensor indicate that something is amiss or when the body sensor is removed.
  • a soldier can include a soldier, an airman or any person that formally participates in military missions. Prevention of friendly fire instances is an important goal of the soldier wireless device.
  • the soldier is in a relatively secure environment in the squad room before leaving for a mission and on the battlefield in the visual presence of other soldiers. At these times, the soldier can be provided with cryptographic material using Secure Network methodologies.
  • a pass holder is an individual who is authorized to enter a facility or attend an event.
  • the pass holder carries a wireless device which is queried at the point of admission.
  • the pass holder also has a body sensor, possibly a wrist band, to which the wireless device communicates.
  • the wireless device records an alarm when the body sensor is removed or when the body sensor records some other event.
  • the issue with the pass holder is to deliver the cryptographic material in a secure manner.
  • the pass holder would put on the wrist band, and have the wireless device communicate with a remote authority via wireless or wired network and receive the cryptographic material and then undergo an authentication procedure using perhaps the telephone or a biometric device in his house.
  • This system would allow a large number of individuals to be continually monitored over a large area. It could be combined with on-site biometric devices.
  • a body sensor is attached to an individual, the individual is carrying a handheld device, and the handheld device talks to the body sensor. If the body sensor is removed or the body sensor detects a trauma, the handheld device records this event in such a way that the handheld device cannot be later reverse engineered to omit the detection of this event.
  • the body sensor, the handheld device, and the installation of the Secure Network assures that when the system communicates with the handheld device it can determine whether the individual carrying the handheld is alive and can authentic him or her.
  • the individual Before the individual goes to the battlefield or applies for admission to a facility or event, the individual must be properly set up with a body sensor and a handheld device in some secure and known environment. This could be an assembly of soldiers before being dispatched to the battlefield or some type of telephone verification or other procedure for pass holder admittance.
  • the handheld device Once the individual has the body sensor and the handheld device, it is then necessary to locate the handheld device in three dimensional space.
  • One technology for doing this is to detect individuals passing through fixed screening devices, and querying the handheld device. The screening devices would talk to the handheld devices through some appropriate interface. The fixed screening devices would be appropriate for perimeter protection and building access.
  • a technology exists for communicating via florescent lights see e.g. www.talkinglights.com).
  • This technology The point is that once an individual, equipped with the handheld and his or her body sensor, is located in three dimensional space, we can be assured that the individual is authentic and has not been replaced by the enemy.
  • This system of securely identifying individuals could be further expanded by developing a network of individuals with body sensors and handhelds inside vehicles which communicate via wireless with remote sensors. This could be used to form a network that would authenticate vehicles entering a facility by authenticating the vehicle and its passengers. There can be a problem of detecting a rogue unauthorized individual inside a vehicle which is analogous to finding a rogue container inside a container pile on a ship.
  • FIG. 1 is a block diagram of one embodiment of a secure detection system network in accordance with the present invention, applied to the shipping container scenario.
  • the secure detection system network implements the Secure Network in the context of protecting one or more shipping containers, such as shipping container 100 .
  • shipping containers can be transported by any number of means, e.g., ship, airplane, train, or truck.
  • the secure detection system network includes remote nodes, monitors, and servers, and optionally robots, which all form nodes in the Secure Network.
  • a remote node such as remote nodes 102 , 104 , 106 , 108 , includes a computer processor and storage having an agent module loaded thereon that causes the remote node to act as part of the Secure Network.
  • each remote node 102 , 104 , 106 , 108 includes a wireless communication interface.
  • the various communication paths are shown as wireless paths by dashed lines between the nodes.
  • each node is configured to communicate with each other node, though it is not essential that this be the case.
  • the remote nodes are configured to communicate with at least one monitor 120 , robot 130 (if included), and server 140 .
  • Each remote node is coupled to a variety of detectors capable of detecting illegal conditions, such as atomic bombs, chemical and biological weapons, human beings and shielding materials.
  • detector 122 is coupled to remote node 102
  • detector 124 is coupled to remote node 104
  • detector 126 is coupled to remote node 106
  • detector 128 is coupled to remote node 108 .
  • Remote nodes 102 , 104 , 106 , 108 are able to receive from the detectors signals indicative of the presence or occurrence of such illegal conditions with respect to container 100 .
  • the detectors are also configured to detect the occurrence of suspicious activities directed against the remote nodes 102 , 104 , 106 , 108 , detectors 122 , 124 , 126 , 128 , or container 110 .
  • each remote node is housed within a tamper resistant box. Detectors may be included in the same box. Each remote node housed in tamper resistant box can be coupled to container 110 via brackets 112 , 114 , 116 , 118 .
  • the set of detectors may also include detectors capable of detecting attacks against the tamper resistant box. Generally, the various detectors discussed herein are known in the art, so not disclosed in detail herein.
  • tamper resistant refers to a structure that has been hardened against tampering, including reverse engineering, to the extent possible under the state of the art of relevant technologies.
  • Such technologies can include physical measures and detection means, including electrical, magnetic, infrared, logical or other sensory means of protection or detection as well as software methods.
  • the resistance to tampering can be increased by various strategies for deploying the nodes using the Secure Network.
  • Tamer evident is considered to fall within the scope of the “tamper proof” or “tamper resistant” concept, in that the tamper resistant box may include means for detecting attempts by an enemy to tamper with it.
  • the tamper resistant box will detect tampering before the enemy realizes that the detection has been made.
  • the box can also act as a decoy. Tamper proof refers to an ideal which, theoretically at least, is unattainable, thus use of “tamper resistant” is generally more accurate.
  • a robot 130 may optionally be included, and can take the form of a portable computer platform.
  • the robot 130 could, for instance, take the form of a handheld device, remote controlled device, or pre-programmed mobile device.
  • the robot 130 forms part of the Secure Network and is configured as a monitor node. Accordingly, the robot 130 can perform auditing activity, such as counting and identifying containers that either do or do not contain remote nodes. For example, a robot could be deployed before entry and/or exit of a port.
  • robot 130 executes an intelligent agent that configures the robot as a node capable of auditing other nodes in the Secure Network.
  • robot 130 includes a wireless communication interface to enable communication with other wireless nodes in the Secure Network.
  • a robot 130 can be enclosed in its own tamper resistant box.
  • robot 130 includes detectors suitable for detecting attacks against its own tamper resistant box.
  • a monitor (or monitor node) 120 forms part of the Secure Network.
  • Monitor node 120 includes a computer processor and storage, and is configured to host and run an intelligent agent capable of configuring the monitor, including installing any downloaded software and files.
  • monitor 120 includes a wireless communication interface that enables it to communicate with various servers (e.g., server 140 ), other monitors, robots (e.g., robot 130 ) and remote nodes to perform auditing of the Secure Network.
  • the monitor node 120 may also be configured to detect suspicious activities directed against it. As with the robot and remote nodes, the monitor node 120 may also be enclosed in its own tamper resistant box. If housed within a tamper resistant box, monitor node 120 may also be configured to couple to detectors capable of detecting attacks against the tamper resistant box. Unlike remote nodes 102 , 104 , 106 , 108 , the monitor node 120 does not directly couple to container detectors, unless required as part of its auditing function. Rather, the monitor node 120 provides an auditing function with respect to the remote nodes 102 , 104 , 106 , 108 themselves, and can also be configured to audit other nodes within the Secure Network. Therefore, the monitor node 120 can receive and process data from remote nodes indicating an illegal condition or attempt to compromise the Secure Network.
  • Secure Network server 140 is a computer, possibly located inside a secure United States government facility or a security management facility, which provides overall management of the Secure Network.
  • the Secure Network server 140 is configured to generate software and data files, including initial encryption keys, for each remote node and monitor node.
  • the software and data files (and encryption keys) are specifically generated for each node.
  • Each node can be given an IP address, which provides a means for the Secure Network server 140 to access the nodes via, for example, the Internet and to distribute the corresponding intelligent agent modules (or agents), software and files to each node.
  • the agent installs the software and files, allowing the node to enter the Secure Network.
  • the Secure Network server may also include detectors capable of detecting attacks against the tamper resistant box.
  • the present invention enables an “active defense”.
  • An “active defense” presumably goes beyond preventing an act that is already underway but either prevents other attacks from occurring or at least identifies a specific attack very early on, before the enemy knows it has been discovered.
  • An active defense contemplates the possibility of capturing or destroying the attackers, including persons who are planning or managing the attack. Monitoring attempts to attack Secure Network nodes provides an active defense.
  • a plurality of, if not all, shipping containers on a single vessel could include some number of remote nodes.
  • the presence of one or more remote nodes in each container being shipped in a vessel could be made a condition for that vessel entering US Ports (e.g., where the vessel is a ship) or crossing a US border (e.g., where the container is being transported on a truck body or by rail).
  • eight containers are shown loaded on a vessel 200 .
  • container 202 includes remote nodes A-D
  • container 204 includes remote nodes E-H
  • container 206 includes remote nodes I-L
  • container 208 includes nodes M-P.
  • container 212 includes remote nodes Q-T
  • container 214 includes remote nodes U-X
  • container 216 includes remote nodes Y-BB
  • container 218 includes nodes CC-FF.
  • the containers can be examined efficiently by the onboard monitor 220 through communication with the remote nodes of each container, while the container is in transit from the foreign point of origin. Such monitoring can determine if any of the containers are storing suspicious materials or are the target of suspicious activities.
  • the remote nodes report to and can be queried by either monitors or servers.
  • the communication path between a remote node and monitor 220 can be direct or via other remote nodes.
  • the path between remote nodes and server 240 can be direct or via other nodes.
  • path 222 shows that remote node B can communicate with monitor node 220 via remote nodes E-F-H-N-P.
  • This path can be continued to server 240 via path 242 , thereby establishing a path between remote node B and server 240 , via remote nodes E-F-H-N-P and monitor 220 .
  • path 242 could also represent communications between monitor 220 and server 240 , independent of communications from any remote nodes.
  • Other paths may also be formed for remote node B to communicate with monitor 220 .
  • remote node DD is shown communicating directly with monitor 220 via path 224 .
  • FIG. 2 also illustrates how a remote node can communicate directly with a server, here remote node FF communicates directly with server 240 via path 244 .
  • FIG. 3 shows yet another configuration of containers on vessel 200 .
  • This is a stacked configuration.
  • it can be difficult to maintain a wireless path between each remote node and the monitor node 220 , server node 240 and, if provided, a robot (not shown).
  • container 210 does not include a remote node.
  • a communication path between remote node K of container 206 would likely not be a direct path, since container 206 is buried in the stack. Therefore, the path may have to go through other intermediate remote nodes, while avoiding container 210 .
  • the path between remote node K and monitor node 220 include nodes L-J-S-T-AA-BB. Other paths could also be formed.
  • the path may also include path 246 between monitor 220 and server 240 .
  • containers that do not contain remote nodes can be readily identified by monitor 220 or a robot prior to the ship arriving at its port (e.g., a US port) or the truck or train arriving at a border (e.g., a US border).
  • Shipping containers loaded on a ship can be examined while loading through an intermediary of a monitor 220 and after loading through the intermediary of a robot.
  • the present invention addresses the problem of inserting detection devices into shipping containers in such a way that a determined, sophisticated enemy cannot defeat the system.
  • detectors and remote nodes are provided at the container.
  • potential strategies for defeating the insertion of detectors and nodes which detect suspicious materials and activities as described above may include:
  • the difficult aspect of the environment is that the detectors, nodes and the communications interface will be in the hands of the potential enemy for some period of time, at least for the period of time necessary to load the container. Also, since the potential enemy is presumed capable of constructing an atomic weapon, the enemy must be presumed able to utilize other advanced technologies suitable for defeating the detectors, remote nodes and interface. Also, if the enemy is conspiring with a disloyal employee of the shipping company, the monitors and the robots could fall into enemy hands.
  • a secure detection system network in accordance with the present invention is particularly suited to maximizing these advantages for the defenders.
  • the capabilities provided by such a system which are relevant to maximizing the above strategic advantages for the defenders are discussed below.
  • Strobed encryption allows for exchanging encryption keys every few seconds between nodes in the Secure Network. This capability can be exploited by constructing a system of nodes so that they can all strobe with one another and each can check on whether the other is being attacked. This makes reverse engineering more difficult because the target is continuously changing encryption keys. In this context, if the information is communicated outside to monitor nodes, information previously sent, even if it could be decrypted, is almost useless to a potential enemy. So, breaking one key does not help break the next. The time advantage between detection of an attack and an enemy's realization that detection has occurred represents an opportunity to mount a defense aimed at penetrating an enemy's infrastructure.
  • the Secure Network can be used to rapidly configure ad hoc networks such that several remote nodes inside a container can be securely linked to one another and to other nodes such as, (a) to a shipboard monitor which will monitor the remote nodes in all of the containers on board, (b) to possibly a monitor which will communicate with the remote nodes while the container is being loaded by the adversary, (c) to possibly nodes in other containers, and (d) to possibly a robot which will count the containers before the ship is ready to leave port.
  • the remote nodes and monitors are provided to shipping companies.
  • the remote nodes and monitors are manufactured and delivered in a tamper-resistant state for installation in containers bound for the United States.
  • the remote node could include the detectors within its tamper resistant box.
  • the nodes could come in different classes, depending upon the type of detectors with which the remote node is configured to interface. The class, nature, type, quantity, and capabilities of the detectors configured to couple to a remote node should remain classified and known only to the server node.
  • the shipper orders one or more containers. For example, the shipper needs a container to ship a particular product to the United States. The shipper arranges with the shipping company for delivery of a container to the location where the shipper will load the container. The shipper and shipping company agree on details such as the size of container desired, when the container will be delivered, the contents of the container, when the container will be ready for pickup, destination, likely weight and so forth.
  • the shipping company enters an order with Coast Guard.
  • the shipping company is registered with, for example, a container control system established by the Coast Guard.
  • the shipping company uses a computer and communicating via the Internet, the shipping company connects to the Secure Network server node and inputs the appropriate information regarding the request for a container received from the shipper.
  • the shipping company initializes remote nodes and monitors to be used by the shipper via the Secure Network server. For example, on the day the container is to be dispatched to the shipper, the shipping company assigns a separate IP address to each of some number of remote nodes, perhaps four, and a monitor node, and also assigns a receptacle number to each remote node assigned to the container.
  • the server node identifies the remote nodes that should be placed in the designated container based on the nature of the cargo to be shipped, the remote nodes known to be in the inventory of the shipping company, and other factors such as, perhaps, the reputation of the shipper, the country of origin, and so forth.
  • a shipping company employee then couples the remote nodes and monitor node to the Internet, enters the respective IP addresses and receptacle number for each remote node and requests initialization from the server.
  • the server generates software and data files necessary to securely network the remote nodes and one or more monitors with the server into a Secure Network, as previously discussed. Additional random procedures can be introduced into the software so that no two remote nodes or systems will appear identical to an enemy attempting to reverse engineer them. The server will also randomly generate initial keys for use when the remote nodes or monitors connect with one another via the Secure Network.
  • the server will query each of the remote nodes and monitors to check system integrity.
  • the remote nodes and monitor will all have serial numbers in their processors, which previously will have been registered with the server.
  • the server will then automatically download and install software on the remote nodes and monitors which are still in the shipping company's possession or control.
  • the remote nodes and the monitors will connect to one another, and immediately begin strobing the encryption keys used between each pair to exchange messages. Strobing is discussed in detail in Appendix G.
  • the shipping company can perform an orthogonal audit, as more fully described in the Appendicies hereof.
  • the installation can, for example, be orthogonally authenticated perhaps by the server's downloading a randomly generated number to be displayed on the screen of shipping company's office computer and then by placing a telephone call to shipping company's office and having the number on the screen entered through the telephone key pad.
  • the authentication is valid even if the shipping company employee supervising the installation is personally hostile to the United States or is working for an enemy.
  • This auditing procedure is in conformity with the methods disclosed to audit a node after installation in the Secure Network.
  • the shipping company installs remote nodes in the container, preferably in numbered, tamper resistant receptacles, perhaps in the four diagonal comers of the container, and delivers the container to the shipper. It would be appropriate to perform another auditing procedure when the remote nodes have been inserted into their appropriate receptacles.
  • the four remote nodes will continue to send messages to one another and to strobe encryption keys with one another.
  • the remote nodes optimally will also remain in contact with a monitor, which can remain in the shipping company's control, and which will remain in contact with the server.
  • An optimal configuration would enable any remote nodes to detect attempts to tamper with it or to remove it from the receptacle into which it has been placed. Any suspected tampering could be detected by the remote node and communicated to other remote nodes or to the monitor or monitors to which the remote nodes are connected.
  • the shipping company then delivers the container to the shipper.
  • the remote nodes and detectors are installed and the remote nodes continue communicating with one another and with a monitor in the shipping company office.
  • the remote nodes should remain connected to a power source. If they are disconnected from the power source this will represent a system violation.
  • the remote nodes could use some type of a rechargeable battery.
  • Containers provided with power sources have been used in global commerce for many years. These power sources could also provide power for remote nodes.
  • the shipper loads the cargo into the container. This is a vulnerable situation because the remote nodes are potentially under the control of the enemy at this time and must withstand attacks designed to destroy, deceive, or reverse engineer them. However, if any remote node can detect tampering, it will communicate with the monitor and could be shut down. If tampering is detected, the container will preferably not be loaded on the ship without human inspection, and the matter should escalate so that appropriate police, military, and forensic activities can be initiated with the objective of capturing and prosecuting the persons who performed the tampering.
  • the container Once the container has been loaded and locked by the shipper, it will be picked up by the shipping company, delivered to the port of departure and then loaded onto the ship.
  • the monitor Prior to loading, the monitor will communicate with the remote nodes in the container, and verify (a) that the remote nodes are in place and have not been tampered with and (b) that they have not detected suspicious materials or suspicious activities. Software on the monitor can also compare the weight of the presumed cargo of the container, and the actual weight of the container. Containers that exceed their expected weights by some predetermined amount will be subject to opening and visual inspection.
  • a robot can be tasked to examine the ship before departure. After the ship is loaded and immediately before departure the robot will traverse the ship to inspect each object that could be a container, and verify that each such object is a container equipped with appropriate remote nodes.
  • the purpose of the robot is to avoid a situation where terrorists, working in concert with port employees and/or employees of the shipper, somehow smuggle an additional rogue container on board. Since this rogue container would not have any remote nodes inside, there would be no way for the monitor to know it is on board or what is inside it.
  • the shipping company can install the monitor node in a tamper-resistant holder on the ship.
  • the monitor will communicate with at least one remote node in each container and remain in contact with each container throughout the voyage to the United States.
  • the monitor onboard the ship will communicate with the robot (if any), and obtain a count of the number of containers on the ship and a report as to the existence of any containers on the ship that lack remote nodes.
  • Containers lacking remote nodes can be unloaded from the ship and refused shipment until they have been opened and inspected by the shipping company and the port authority. If they are determined to be legitimate containers, the shipping company will install properly authenticated remote nodes before permitting the containers to be sealed and shipped.
  • the robot After performing the inspection, the robot can be removed from the ship, reinitialized, and be used to inspect the containers on another ship.
  • a robot can also be used to examine a ship before entry into a US port. When the ship reaches the US port, the Coast Guard will be able to communicate with the monitor on board the ship and will be able to verify that the ship is composed entirely of containers with remote nodes and that no sensor has detected improper materials. The robot could also re-examine the ship to determine that all containers have remote nodes, that is, that a rogue container has not been loaded on board during the voyage.
  • One method might be to have a robot that remains on board the ship.
  • the robot could be reinitialized automatically and could perform its inspection without the ship having to be boarded by the Coast Guard.
  • a second method is for the Coast Guard to board the ship and bring a robot with them. The robot would be initialized as a node and authenticated when it was on board the ship.
  • a shipping company could already have appropriate robots or controls on board so that the functions performed by an robot could be performed by controls already on board the ship. In this case, it would be appropriate to integrate the monitor with on board system controls in an appropriately secure manner.
  • one or more remote nodes could be placed inside such holds.
  • the hold could be treated as a container.
  • the hold is typically bigger than a container, although individual items of cargo in the hold are usually smaller than items loaded into a container, and, therefore, would generally be less capable of providing shielding against detection of suspicious materials.
  • Containers seeking to enter the US by truck or by rail can be held to the same requirements. That is, they could be required to contain remote nodes which could be examined by a monitor prior to being permitted US entry.
  • the remote nodes can be manufactured and shipped to include detectors in their tamper resistant containers. What detectors are actually located in a specific remote node should remain highly classified, since that information would aid those interested in defeating the nodes. The detectors that are introduced into any specific container should depend on the cargo that the shippers claim will be shipped. The decision as to which remote nodes should be installed into a container should be made by the server based on information which only it has.
  • the values which the detectors will look for should be dynamically configured by the server immediately before the container is shipped. This is essentially an arms race, wherein as the enemy becomes more sophisticated in ways of shielding bombs the detectors are improved to overcome the shielding. It is assumed that whatever the current state of detection and shield technology, that detection can be improved by getting detectors inside the container. Also, deploying an inside-the-container detection system provides an additional layer of protection that augments and backs up whatever detection is possible from satellites or other out-of-the-container scanning methods.
  • each remote node contained one or more Geiger counters and/or other detectors and possibly a way of detecting if the remote node were moved from its brackets. Just beating this system would require time and design on the part of potential enemies. Buying time is important because in the meanwhile perhaps the bomb manufacturing plant could be discovered and destroyed. Perhaps better sensors could be developed which could then defeat any improved shielding the enemy had developed. In any event, the Secure Network provides a significantly higher degree of security than might otherwise be available
  • One of the strategies of the secure detection system is to limit the ability of the enemy to experiment with the detectors.
  • a second, somewhat related strategy is to detect an attack on the remote nodes before the enemy knows that it has been detected, thereby pinpointing the existence and location of enemy facilities. It is possible using a system that includes the Secure Network with detectors to detect attempted enemy attack before the enemy knows that his attack is detected. This actually represents an active defense.
  • the detecting strategy can be improved to correspond to the cargo which the shipper claims will be present.
  • the system proposed in this invention is particularly well suited to dynamically modifying the detection strategy to suit the proposed cargo.
  • the decision as which remote nodes are selected to be included in the container can be dynamically made, by the server, at the moment the remote nodes are prepared for subsequent insertion in the container.
  • the detection strategy that will be used by the remote nodes, given a specific set of detectors can be dynamically configured at this moment.
  • the selection of the remote nodes and detectors, and the configuration of the detection strategies can be made on the basis of information available only to the server.
  • cargoes might be of such a nature that it would be impossible to determine whether a bomb was hidden inside, in which case these cargoes would require manual inspection. Examples of such cargoes could be the legitimate shipment of nuclear materials or legitimate shipment of nuclear shielding materials.
  • the detectors may be located in the same box as the remote nodes, or in other embodiments detectors could external to whatever box holds the remote nodes.
  • the present invention is structured so that actions taken by human beings can be independently verified by other means. Since the system does not rely on any human action that cannot be separately verified it can therefore be orthogonally secure.
  • a Secure Network in accordance with the present invention is composed of nodes, which can be objects that run as threads and which are capable of securely connecting to other nodes and of interfacing to a wide variety of other computer executables and libraries running on Windows or UNIX.
  • Strobed encryption is the procedure for dynamically changing encryption keys every 30 to 60 seconds, for example.
  • the details of one implementation of strobed encryption are provided in Appendix G.
  • the parties begin with randomly generated startup or initial keys, which are hidden from everyone, including the parties themselves.
  • key exchange protocols such as EKE or kerberos, start with only a remembered password and have no mechanism for changing keys during a particular session.
  • Strobed encryption in accordance with the present invention depends on other technologies of the Secure Network, such as automatic network generation, automatic installation, orthogonal authentication (see Appendix B) and audit, and data packaging (see Appendix C).
  • the Secure Network uses only encryption primitives that are public, standard, and tested. New encryption primitives can be added as they become available.
  • Packaging as used in the Secure Network, is an object-oriented framework for creating and compressing packages suitable for use over TCP/IP.
  • the packaging framework include an Item class, which allows derived objects to model virtual any data format, and to apply compression on a field by field basis. Items and packages can be inserted into and extracted from packages and packages can be inserted into warehouses, which are disk resident files.
  • the Secure Network uses its packaging methodology for general data transport and for storage and transport of encryption keys.
  • the Secure Network has a network generation program, which automatically generates configuration information needed to install a node. This program randomly generates the startup keys for all nodes. These keys will strobe immediately after the first connection.
  • the network generation program also builds the executables and dynamically embeds randomly generated keys into the executables. See Appendix D.
  • the Secure Network has an installation procedure which permits automatic installation of an entire network or parts of a network and allows for orthogonal audit and authentication of every network node, discussed in Appendix E.
  • Nodes in the Secure Network connect to other nodes using TCP/IP. Nodes can directly connect to some arbitrary number of nodes. By connecting nodes going through intermediate hops, an arbitrarily large Secure Network can be constructed.
  • the node can be modeled in C++ as a class derived from an node thread class.
  • the node class is inserted into an executable or a COM object by means of a pointer.
  • the node class has an embedded package, and this package contains the information generated by the generator which allows the node to connect to other nodes.
  • the process that manages a node can do other things.
  • database servers can be nodes.
  • a process that runs a browser can be a node.
  • Intermediary routers that are used in a massive Secure Network can be nodes. (See Appendix F).
  • the network diagram of the massively scalable Secure Network shows some 27 different nodes. Each node has a different number, which is located in the lower right hand corner of the box on the diagram.
  • the server has a generator program, which, using a template, supplies all of the values needed for the various nodes in a Secure Network to connect to one another.
  • the formal, exact definition of a node is that a node is an object created by the generator, which has the characteristic of being able to connect to other nodes.
  • To define the relationship between a process and a node at least one process is required to manage a node. Although, a process could manage more than one node.
  • the first assumption is that, when authenticating humans, one cannot go and “look” to see and verify the identity of the person at the other end of the connection.
  • the Secure Network system goes and “looks” (using biometrics, physical facilities, human audit, telephones, cross checking with other databases, and business procedures) to “see” that the person on the other end of the connection is actually who he/she claims to be.
  • Assumption Two No reinstallations. Assumption two, which the Secure Network does not accept, is that installation is something that happened in the past and will not happen again for many months. Since the procedure can be automated and because it is easy to accomplish, the Secure Network is designed on the principle that critical applications will be installed and orthogonally authenticated frequently, e.g., every morning. The principles of the orthogonal authentication have been outlined herein, as have the principles of automatic installation.
  • Another important aspect of machine generated automatic installation of applications is that it takes installation out of the hands of system administrators, who, if they are corrupt, may install software which is not allowed. While reinstalling, the Secure Network installation procedure will destroy possibly infected examples of its own software. While reinstalling, the Secure Network will check for other examples of unauthorized software.
  • Orthogonal authentication as implemented within the context of the Secure Network strengthens security by requiring multiple inputs from unrelated sources as a constant check on security decisions. Orthogonal authentication also eliminates the need for digital certificates and extends security procedures into the machine layer so as to mitigate the potential failings of human guards.
  • the problem that digital certificates are designed to solve is to determine whether the person on the other end of the connection is Alice or some imposter such as Eve.
  • Alice is a person with sufficient authority to access computer networks that would enable her, if she were so inclined, to perform some devastating action, such as crashing a NASA mission, siphoning off enough money to put a bank out of business, releasing nuclear materials to terrorists or loading weapons of mass destruction into a container.
  • Alice well and we do want to know Alice well or else we will not admit her to our network, we find that she has many characteristics that can be verified.
  • Alice works somewhere, for example in Building 302 in Acme Complex in Anytown, AnyCountry.
  • Acme Complex has installed a facial scanner at the building entrance. If Alice has not successfully passed through the facial scanner in Building 302 today, or if she has already left the building, a person on the other end of the connection seeking access is not Alice.
  • Alice has a supervisor named Bob. If we contact Bob to verify that the person at Alice's desk is Alice, and he fails to do so within some period of time, we may conclude that the person at the other end of the connection is not Alice.
  • digital certificates can be stolen.
  • Fifth, digital certificates are often issued by third party authorities, which means the organization has to rely on the security of a third party it does not control.
  • the Secure Network system sends Secure Network packages directly over TCP/IP.
  • a package is an object which will turn itself into a stream and unpack itself from a stream.
  • a stream is a set of bits that can be sent over TCP/IP.
  • the Secure Network packaging software also contains an Item class. Objects derived from the Item class can model any data format. Items can be inserted into and extracted from packages. Through the use of virtual functions, a package can insert and extract a derived Item which it has never seen before.
  • the advantage of the Item class is that one can develop specific data formats for specific purposes, and also that compression can be applied at the Item level for data that is highly repetitive. Items can contain longs, integers, bytes, bits, strings, and streams. Packages can be inserted into and extracted from packages. Packages have their own compression methods. Keys are typically generated inside Items as streams; items are inserted into packages, the package is compressed, and then encrypted with another key. No keys are stored in the clear. Keys are generally not stored on disk, and certainly not on the same disk where the files they encrypt are located.
  • the Secure Network can contain warehouses.
  • a warehouse is a file into which packages can be inserted and extracted. Packages are always compressed and usually encrypted. Warehouses permit fast searches for packages.
  • the compression ratio for a package depends on the type of data that is inserted. Keys and random numbers are changed but not made smaller after compression. Certain other types of data can be compressed up to 10 times. Packages are also used to send application data and for key strobing. Any data loss or alteration will render the entire package unusable and unrecoverable and therefore immediately noticeable.
  • the Secure Network generator generates all of the executables and data files necessary to start a process at a particular IP address, and usually executed on the Secure Network server. Most of the data files are Secure Network warehouses, which store packages encrypted with a hard key, just randomly generated, which is embedded within the executables.
  • the Secure Network generator generates network parts from a template.
  • the generator is critical for implementing strobed encryption and for extending the Secure Network system back through system design, testing and build.
  • By putting the template and the generator under orthogonal audit control, control over who can design, build, test, and install a given network and who approves the design is possible.
  • the source code is checked for network calls other than through the Secure Network API and for hidden back doors by other methods.
  • the Secure Network can provide start up keys that are only minutes old. If 10,000 employees in a large facility were due to access the computer facilities at 8:00 AM, a portion of the network generation might occur half an hour earlier. The last operation to occur would be the generation of the startup keys, which could be arranged to be within minutes rather than hours of the time a node was downloaded and installed.
  • Network installation means delivery of software and data files to a particular computer, starting a process to manage each Secure Network node on that computer, and providing some type of orthogonal authentication when the nodes have begun to connect. Nodes know all of the other nodes to which they are allowed to connect. When a node is started by a process, it automatically connects with all other allowable nodes with which it can establish a TCP/IP connection, and immediately begins strobing encryption keys. A node has available to it an initial set of encryption keys for each allowable connection.
  • the generator delivers the node files to an Secure Network database, and then creates a self-executing file called an intelligent agent.
  • the intelligent agent is downloaded to a target site or device. When it is run, it knows how to connect to the database, and downloads and installs the files from the Secure Network database.
  • This has a number of advantages.
  • One advantage is that only the agent knows how to find the installation database. This is a prevention against denial of service attacks. It is difficult to conduct a denial of service attack against a database which is hidden.
  • this design facilitates a single installation at a known site. The agent knows where it is supposed to be, and if it is not where it is supposed to be, will not work at all.
  • the database knows that a given agent is allowed to install only once, so if the same agent tries to install twice, something is wrong. This use of the agent might alleviate the need to telephone a password to the target site, although perhaps it is not a bad idea to add this embellishment anyway.
  • a Secure Network node listens on a port/IP address which has been randomly generated seconds before the installation and which is never made public; the node only accepts one connection to any other node; it knows what it is supposed to be listening for and can determine a fraudulent connection immediately if the IP address is wrong and after a single packet exchange, if the keys are wrong.
  • a package If a package is not correct (it cannot be decrypted, or after decryption, it cannot be inflated, or the check digit is wrong, or it cannot be unpacked), the package is rejected, and after a small number of such packages, the connection is closed.
  • this procedure might be as follows: the employee enters the building, passing through a biometric device such as a facial scanner or hand scanner; the employee enters his or her work area, passing through another biometric device.
  • the employee turns on his or her computer, and uses a finger print scanner located on his or her desk. A minute later the telephone rings and the employee answers it.
  • the computer then admits the employee to the applications on the network he or she is authorized to use.
  • the Secure Network can connect two nodes or dozens of nodes, or even thousands of nodes.
  • a portion of a massively scalable Secure Network architecture is shown below in FIG. 4 .
  • the Secure Network has two parts. One side is used for strobing and the other side for sending application data.
  • the top level node, node 1 controls which side is used for strobing and which side is used for sending data.
  • node 1 sends messages so that the side previously used for strobing is now used to send data, and the side previously used to send data is now used for strobing.
  • the amount of time after completion of a strobe on one side is dynamically configurable and can be used to control the amount of resources used by the system.
  • any two nodes can be directly connected; otherwise nodes connect to nodes by going through various intermediary hops.
  • the design possibilities are very flexible. As a package passes through the hops, it is protected by end-to-end strobed encryption, in which the keys strobe between the node at which the package originated and the node that is its destination.
  • Application nodes have been arbitrarily numbered in a sequences beginning with 32261 and 65441 in order to illustrate a hypothetical network of approximately 10,000 application nodes.
  • Nodes at indenture levels 0 though 4 that is all nodes with numbers less than 9999, are router nodes.
  • the system has two separate networks of router nodes, a system with positive numbers and a system with negative numbers.
  • Nodes at indenture level five can communicate by sending packages through either side of the network.
  • Nodes can also be directly connected with one another. For example, 32262 directly connects with 65447.
  • Strobed encryption is a proprietary protocol which changes both asymmetric and symmetric keys periodically. A strobe occurs at the moment a connection is made and then periodically thereafter.
  • the first strobing exchange starts with a set of keys that are present on network installation.
  • Network keys and all files and software needed to connect to nodes are generated automatically by the Secure Network generator and downloaded through one of the Secure Network installation methods.
  • the time between generating the network parts and the first connection could be only a few minutes.
  • the node will be “audited ” by being orthogonally authenticated in some way. If someone in the minute or so between the generation of the A/B connection parts and the real installation of A and B, could steal all of the parts to make the A connection, and could install A, and spoof the IP address, and could somehow connect to B, and do the first strobe, when it comes time for the actual A to connect, B will not connect a second time to A. It will become immediately obvious that something is wrong.
  • the Secure Network is designed so that only one connection between two nodes is possible.
  • [] is a compressed ANGEL package
  • refers to a non-compressed ANGEL package.
  • (key) means encrypt what is to the right with key.
  • a comma separates packages and items that have been inserted into a package.
  • Index means an item that usually appears at the front of the payload package.
  • a package is a C++ object which is capable of turning itself into a stream suitable for transport over TCP/IP and of recovering itself from a TCP/IP stream.
  • the package is also a container into which other packages can be inserted and from which other packages can be extracted. Items can also be inserted into and extracted from packages. Extraction from and insertion into a package is only possible if the containing package is non-compressed. Compressed packages can be inserted into and extracted from non-compressed packages.
  • An Item is a C++ object which, through derivation, can model any data format. Packages have their own compression methods. It is also possible to selectively compress data as the data is added to an item.
  • Initial keys are first generated.
  • the following initial keys are generated for encrypting packages sent between two sides of a TCP/IP connection. These keys are already installed either by the installation program or by the previous strobe. Strobing involves randomly generating and changing these keys.
  • the initial keys include:
  • Package encryption is also used.
  • the package actually sent over TCP/IP is referred to as the payload package.
  • This package consists of an Index item plus some number of other packages and items.
  • the Strobe sequence is as follows:
  • State0 is the initial state after two nodes have been installed.
  • Node B listens for a connection.
  • Node A waits for a response from Node B.
  • Node B will decrypt the incoming stream with k in , then with e in , then inflate the package.
  • the package will now be ⁇ Index, p A ⁇ , that is, it is a non-compressed package containing two objects, an Index object, the public key from Node A, p A .
  • k in and e in are identical to k out and e out used on the connect side. If this is the first strobe, this match up will be performed by the generator and the installation procedure. If this is an ongoing strobe, this match would have been performed by the previous strobe.
  • Node B waits for a response from Node A.
  • Node A waits for a response from Node B.
  • nodes A and B may now begin transmitting data to each other encrypted using their respective k out , k in , e out , e in keys.
  • the Secure Network system can send a one-time pad encrypted with other one-time pads and other session keys. If an enemy were to attempt a brute force attack on encrypted “text”, when the enemy had guessed the correct method of decryption, the enemy would realize that it had succeeded because the encrypted text would be plaintext and identifiable as such. However, applying a brute force attack to recover an encrypted one-time pad is more difficult because of the problem of distinguishing between a correctly and incorrectly decrypted one-time pad.
  • the one-time pad is merely a sequence of random numbers.
  • the “correctly decrypted one-time pad” can only be identified as correctly decrypted when it is applied to some cipher text and produces something recognizable as plaintext. Under the Secure Network system, the cipher text that can be used to identify a correctly decrypted one-time pad will not be sent until later, so at the very least a brute force attack cannot be successfully implemented against the one-time pad until the plaintext is sent.

Abstract

A secure detection network system includes plurality of remote nodes, each remote node comprising a set of detector interfaces configured to couple to a set of detectors disposed to detect the presence of an illegal asset within a shipping container; at least one server node configured to initialize, install, and authenticate each remote node in the plurality of remote nodes, including delivering to each remote node an agent module, said agent module for each remote node comprising a node specific configuration file defining a set of nodes with which the remote node can communicate and a different encryption means corresponding to each node in the set of nodes; and a communication path coupling the plurality of remote nodes and the at least one server node.

Description

CROSS REFERENCE TO RELATED APPLICATIONS
This application claims the benefit of priority under 35 U.S.C. §119(e) from commonly owned U.S. provisional patent application Ser. No. 60/390,204, entitled WEAPON DETECTION METHOD AND SYSTEM, filed Jun. 20, 2002 and U.S. provisional patent application Ser. No. 60/390,205, entitled ORTHOGONAL SECURITY SYSTEMS FOR PROTECTING HIGH RISK INFRASTRUCTURE, filed Jun. 20, 2002.
This application claims the benefit of priority under 35 U.S.C. §120 from co-pending, commonly owned U.S. non-provisional patent application Ser. No. 09/441,403, entitled SYSTEM AND METHOD FOR INSTALLING AN AUDITABLE SECURE NETWORK, filed Nov. 16, 1999.
STATEMENT OF GOVERNMENT INTEREST
The U.S. Government has no interest in or to the present invention.
FIELD OF THE INVENTION
The inventive concepts relate to systems and methods for ensuring security of sensitive assets. More specifically, the present inventions relates to systems and methods that implement secure communications to ensure security of the sensitive assets.
BACKGROUND
There has been a recognition that the United States is at risk of the delivery of weapons of mass destruction to its ports by enemies employing a strategy of hiding such a weapon in a shipping container. Various schemes have been proposed for x-raying containers or otherwise examining containers as they are loaded on ships in the foreign port. Such schemes, however, can be very limited in effectiveness since they can be defeated with x-ray shielding, vulnerable to compromise by rogue employees and the contents of the containers altered after they are loaded in the foreign port.
To a limited degree, the notion of embedding detecting devices in a container, which communicate with external systems, has been implemented in unsecure applications. For example, Sensitech, based in Beverly, Mass. (www.sensitech.com), provides solutions in the food and pharmaceuticals fields that are used for monitoring temperature and humidity for goods in-process, in-transit, in-storage, and on-display. So, temperature and humidity monitors can be placed in storage and transit containers to ensure desired conditions are maintained.
However, such data is not generally considered sensitive with respect to security issues. Rather, it is used for ensuring the products in the container do not spoil by being subjected to unfavorable temperature and humidity conditions. Consequently, secure communications, tamper resistance and detection are not particularly relevant issues in such settings. Additionally, such monitors do not monitor for the presence of suspicious content or materials, no matter where they may be introduced in the chain.
Even if detectors are introduced into a container and interfaced to an external system, an “enemy” may employ any of a variety of strategies to defeat such a detection system. For instance, an enemy may attempt to shield the suspicious materials or activities from the detectors; defeat the communication interface between the detectors and the external system, so that the interface does not report evidence of suspicious materials or activities sensed by the detectors; disconnect the detectors from the interface; surreptitiously load a container that contains an atomic weapon, but that does not contain detecting devices, onto a container ship; overcome external systems so that they incorrectly report on the status of the detectors.
The difficult aspect of the environment is that the detecting devices and the communications interface will be in the hands of the potential enemy for some period of time, at least for the period of time necessary to load the container. Also, since the potential enemy is presumed capable of constructing an atomic weapon, the enemy must be presumed able to utilize other advanced technologies suitable for defeating the detecting devices and the interface.
SUMMARY OF THE INVENTION
A system and method for providing a secure detection network system includes a plurality of nodes, each node comprising a processor and storage means. Such nodes include a plurality of remote nodes, each remote node comprising a set of detector interfaces configured for coupling to a set of detectors disposed for detecting the presence of an illegal condition. The illegal condition may include the presence of one or more suspicious materials, including chemical weapons, biological weapons, nuclear weapons, chemical agents, biological agents, radioactive materials, illegal drugs, explosive materials or devices, or shielding means. The illegal condition may also include a suspicious activity, including an attempt to defeat a remote node or detector. The remote nodes can be provided within a tamper resistant box, that could be coupled to a sensitive, for example. Sensitive assets could include, for example, assets such as a shipping container, vehicle, human, event, room, area or building. Within the box may also be provided a set of detectors. The detectors are configured to detect the illegal condition, and could also detect an attempt to compromise the detector, remote node, or sensitive asset.
To establish a secure network, and each node therein, at least one server node generates and distributes to each node an intelligent agent module and a set of node specific configuration files, selectively including software and data files. For each node, the configuration files include information defining for that node a set of other nodes with which the node can communicate. This includes providing a different encryption means corresponding to each node in the set other nodes. Installation of a node includes executing the downloaded to agent and configuration files. Once installation is complete, strobing of the encryption means (e.g., key pairs) between nodes can be included.
At least one monitor node can be provided to couple to and audit other nodes in the secure network, including the remote nodes. This auditing function may include receiving signals indicating an illegal condition or tampering with a remote node. A robot node could also be provided, as another form of monitor node, which could be hosted on a portable platform. These nodes could include wired or wireless interfaces, as could the server nodes and the remote nodes.
Selectively causing one or more nodes to terminate communication and to remove itself from the secure network in response to one or more termination events may also be provided. In such a case, the one or more termination events could include detecting tampering of one or more remote nodes.
Communication between remote nodes and other nodes, such as a monitor node or server node, could be accomplished via one or more other intermediate nodes. Subnetworks may be formed from a set of remotes nodes, wherein each subnetwork could provide a portion of the communication path to the monitor node and server node for a given remote node.
As an additional form of security, orthogonal authentication could also be provided, such as by using independent biometric information about an individual.
BRIEF DESCRIPTION OF THE DRAWINGS
The drawing figures depict preferred embodiments by way of example, not by way of limitations. In the figures, like reference numerals refer to the same or similar elements.
FIG. 1 is a block diagram of a secure detection system network, in accordance with the present invention.
FIG. 2 is a block diagram of a portion of the block diagram of FIG. 1, with a plurality of containers.
FIG. 3 is a block diagram of a portion of the block diagram of FIG. 1, with a plurality of containers in a stacked configuration.
FIG. 4 is a block diagram of a massively scalable Secure Network, in accordance with the present invention.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
A system and method in accordance with the present invention provide a secure network having interfaces to detectors configured to detect any of a number of undesired conditions. Such a system and method provide security for network nodes against attacks, whether intentional by an enemy or inadvertent by friendly forces. Such a system and method include a plurality of nodes configured to communicate in a highly secure and robust manner. Several of the nodes include or interface with one or more detectors, monitors, or sensing devices (collectively, “detectors”) configured to sense the presence or introduction of an “illegal condition”, such as suspicious materials or activities.
Generally, suspicious materials include any material of a nature such that, if detected, would present a reason to open a container and examine it. Such materials could include drugs, nuclear, chemical, biological or other hazardous materials, devices, compositions, or agents, or any weapons or agents of mass destruction, including nuclear weapons, explosives, chemical weapons, and biological weapons, as well as shielding material that would shield radiation, explosives or biological weapons from detection. Suspicious materials could also represent materials that were at variance with the materials that the shipper states are supposed to be in the container.
Generally, suspicious activities would involve detection of any activity such that, if detected, would represent a reason to open the container and examine it or to otherwise consider a formerly trusted asset as untrusted. Suspicious activity could include electromagnetic radiation, sonar, or heat variations, or removal or tampering with a detector or remote node. For example, removing a detector or remote node from a container might be indicative of an attack on a detector, node or container. The presence of human beings inside a container after the container had been closed and was ready for shipment would also constitute suspicious activities, or the presence of a human that has not been properly authenticated.
In the preferred form, installation, authentication, and auditing of nodes and secure communication among the nodes is accomplished using the systems and methods disclosed in U.S. Pat. Nos. 6,067,582; 6,535,254 B1, and U.S. patent application Ser. No. 09/441,403, all of which are incorporated herein by reference (collectively describing the “Secure Network”). Such a Secure Network is also further described in Appendices A-G hereof.
As an overview, the Secure Network includes at least one server node that distributes intelligent agents (or agent modules) to devices, and any other software and data necessary to configure and enable the node. Each agent module is specific to the device to which it is distributed. A device properly configured with an agent module is referred to as a node. The node includes information received from the server node that identifies other nodes with which the agent's node is to communicate. Each pair of nodes that is configured to communicate will be configured with encryption means unique to that pair of nodes' communication, which may take the form of unique key pairs. These key pairs may be strobed to further enhance security. The agent module installs any applications or software distributed from the server node to the agent's node. The server node may also reinstall the network at any time, e.g., in response to loss of a node or a determination that a node has been compromised. Additionally, a monitor node can be included to audit a group of nodes.
In the case of human interaction with or auditing of a protected asset (e.g., a container) preferably authentication of the auditor is required. In such a case, the authentication could be provided, at least in part, using orthogonal authentication, i.e., at least two independent means of authentication. For example, a first means of authentication could be by entry of user ID and password. A second means of authentication could be by biometric information (or bioinformatics), such as a palm, hand, finger print, retina, or face scan. Orthogonal authentication is discussed in greater detail in Appendix B.
There are several exemplary scenarios in which the present invention may be implemented. In a first scenario, a wireless device or devices (i.e., “remote nodes”) may be attached to or embedded in shipping containers. The remote nodes may couple by wired or wireless means to various detectors configured, for example, to detect weapons of mass destruction. The detectors can be located inside the container and distributed as needed to adequately perform their surveillance functions. The detectors can be packaged with remote nodes or external to the remote nodes. The remote nodes are queried by appropriate external monitor systems to determine if the nodes and detectors have sensed weapons of mass destruction or other contraband. One issue to be confronted in such a scenario is that an enemy might attempt to sabotage or reverse engineer the nodes so that they falsely report a safe status, so that the container would pass query by authorities. This scenario is referred to as the shipping container scenario.
In another scenario, wireless remote nodes may be attached to soldiers so that these nodes can be queried on the battlefield to determine whether a person is friend or foe. One issue here is that an enemy might capture the soldiers or the equipment and reverse engineer the wireless remote node, thereby allowing the enemy to masquerade as a friend. Conversely, friendly forces might mistakenly consider a soldier on the battlefield who cannot be authenticated to be the enemy and open fire. This scenario is referred to as the soldier scenario.
In yet another scenario, wireless remote nodes may be attached to equipment such as tanks or airplanes. In such a case, the remote nodes can be queried on the battlefield to determine whether the vehicle is friend or foe. This scenario is referred to as the vehicle scenario.
In still another scenario, wireless remote nodes may be attached to individuals so that the individuals can gain authorized access to a building or an event. An issue to be confronted is that an enemy may capture an authorized individual, reverse engineer the remote node, and gain unauthorized admission. This scenario is referred to as the pass holder scenario.
In each scenario above, the wireless remote node passes through the following stages:
    • (1) A secure stage or stages, where the wireless remote node will be securely provided with cryptographic material.
    • (2) An insecure stage, where the wireless remote node will be subject to attack by an enemy.
    • (3) A stage where the wireless remote node will be able to detect an attack by an enemy.
    • (4) A stage where the wireless remote node will be queried by an external responsible agent (e.g., military or civilian authorities).
Provided in accordance with one aspect of the present invention, is the ability to detect in stage (4) if an enemy attack has occurred in stage (3). This goal could be achieved by providing in stage (4) a measure of the probability that an attack has or has not occurred in stage (3). An additional goal in the soldier and vehicle scenarios is to positively identify an unknown person or vehicle as friend or foe. Table 1 shows, for each scenario, a set of secure stages and a corresponding set of attack detection approaches, as examples.
TABLE 1
Scenario Secure Stages Attack Detection
Shipping Manufacturing plant Several devices monitor one
Container Shipping Line premises another inside the same
US Port container
US Controlled facilities Several devices monitor one
another across different
containers
Other sensors detect WMD
Individual device senses
attack against it
Soldier Squad room before Device attaches to body
mission sensor
Presence of other soldiers
or equipment during
mission
Military Before takeoff or before Device attaches to sensors
vehicle or mission embedded in vehicle.
airplane For vehicle, in presence Device attaches to body
of other soldiers or sensors or devices of
equipment occupants
Pass From home via Device attaches to body
holder telephone. sensor
Company facility
Shipping Container Scenario. Each shipping container would contain one or more wireless remote nodes that is configured to communicate internally with one another and externally with other nodes. The remote nodes would include an interface to facilitate coupling to various sensors disposed to detect the presence of illegal conditions within the container. Such detectors could, for example, be embedded in or attached to the container, as could be the remote nodes. In addition to sensing the presence of illegal conditions, the sensors could be configured to detect access to the container, whether authorized or unauthorized. Illegal conditions could be the presence of any one or more of dangerous chemicals, biological agents or radioactive materials, explosives, drugs, or the like.
The shipping container will at various times be in facilities that are relatively secure, such as the manufacturing plant or a US Port or US controlled facility. At these times, the remote nodes can be securely provided with cryptographic materials via the Secure Network.
The wireless devices would detect an attack when they sensed prohibited substances or when an individual device sensed that it was being attacked. Several remote nodes could also continually monitor one another inside the container. Adjacent containers could also monitor one another.
Soldier Scenario. The soldier will have a wireless device connected to a body sensor. An attack will be sensed when reports from the body sensor indicate that something is amiss or when the body sensor is removed. A soldier can include a soldier, an airman or any person that formally participates in military missions. Prevention of friendly fire instances is an important goal of the soldier wireless device.
The soldier is in a relatively secure environment in the squad room before leaving for a mission and on the battlefield in the visual presence of other soldiers. At these times, the soldier can be provided with cryptographic material using Secure Network methodologies.
Military Vehicle or Airplane Scenario. The number of friendly fire instances in the Iraq war indicates the need for methods of securely identifying unknown vehicles and aircraft. The invention described herein can be used to assure identification of vehicles and airplanes over wireless. Of course, in practice on the battlefield, it will be extremely important to have a system that tests that the wireless identification systems are correctly operating immediately before a vehicle or airplane is put into combat.
Pass Holder Scenario. A pass holder is an individual who is authorized to enter a facility or attend an event. The pass holder carries a wireless device which is queried at the point of admission. The pass holder also has a body sensor, possibly a wrist band, to which the wireless device communicates. The wireless device records an alarm when the body sensor is removed or when the body sensor records some other event. The issue with the pass holder is to deliver the cryptographic material in a secure manner.
One possibility is for the pass holder to become authenticated at home before leaving for the event. The pass holder would put on the wrist band, and have the wireless device communicate with a remote authority via wireless or wired network and receive the cryptographic material and then undergo an authentication procedure using perhaps the telephone or a biometric device in his house. This system would allow a large number of individuals to be continually monitored over a large area. It could be combined with on-site biometric devices.
In the soldier and pass holder scenarios, a body sensor is attached to an individual, the individual is carrying a handheld device, and the handheld device talks to the body sensor. If the body sensor is removed or the body sensor detects a trauma, the handheld device records this event in such a way that the handheld device cannot be later reverse engineered to omit the detection of this event. The body sensor, the handheld device, and the installation of the Secure Network assures that when the system communicates with the handheld device it can determine whether the individual carrying the handheld is alive and can authentic him or her.
Before the individual goes to the battlefield or applies for admission to a facility or event, the individual must be properly set up with a body sensor and a handheld device in some secure and known environment. This could be an assembly of soldiers before being dispatched to the battlefield or some type of telephone verification or other procedure for pass holder admittance.
Once the individual has the body sensor and the handheld device, it is then necessary to locate the handheld device in three dimensional space. One technology for doing this is to detect individuals passing through fixed screening devices, and querying the handheld device. The screening devices would talk to the handheld devices through some appropriate interface. The fixed screening devices would be appropriate for perimeter protection and building access. As an example, a technology exists for communicating via florescent lights (see e.g. www.talkinglights.com). There is also a technology for illuminating devices with light and receiving a response via retroreflection. There are numerous developments of this technology. The point is that once an individual, equipped with the handheld and his or her body sensor, is located in three dimensional space, we can be assured that the individual is authentic and has not been replaced by the enemy.
This system of securely identifying individuals could be further expanded by developing a network of individuals with body sensors and handhelds inside vehicles which communicate via wireless with remote sensors. This could be used to form a network that would authenticate vehicles entering a facility by authenticating the vehicle and its passengers. There can be a problem of detecting a rogue unauthorized individual inside a vehicle which is analogous to finding a rogue container inside a container pile on a ship.
FIG. 1 is a block diagram of one embodiment of a secure detection system network in accordance with the present invention, applied to the shipping container scenario. In this embodiment, the secure detection system network implements the Secure Network in the context of protecting one or more shipping containers, such as shipping container 100. Such shipping containers can be transported by any number of means, e.g., ship, airplane, train, or truck. The secure detection system network includes remote nodes, monitors, and servers, and optionally robots, which all form nodes in the Secure Network.
A remote node, such as remote nodes 102, 104, 106, 108, includes a computer processor and storage having an agent module loaded thereon that causes the remote node to act as part of the Secure Network. In this embodiment, each remote node 102, 104, 106, 108 includes a wireless communication interface. The various communication paths are shown as wireless paths by dashed lines between the nodes. As shown, each node is configured to communicate with each other node, though it is not essential that this be the case. Also, the remote nodes are configured to communicate with at least one monitor 120, robot 130 (if included), and server 140.
Each remote node is coupled to a variety of detectors capable of detecting illegal conditions, such as atomic bombs, chemical and biological weapons, human beings and shielding materials. In FIG. 1, detector 122 is coupled to remote node 102, detector 124 is coupled to remote node 104, detector 126 is coupled to remote node 106, and detector 128 is coupled to remote node 108. Remote nodes 102, 104, 106, 108 are able to receive from the detectors signals indicative of the presence or occurrence of such illegal conditions with respect to container 100. Preferably, the detectors are also configured to detect the occurrence of suspicious activities directed against the remote nodes 102, 104, 106, 108, detectors 122, 124, 126, 128, or container 110.
Preferably, each remote node is housed within a tamper resistant box. Detectors may be included in the same box. Each remote node housed in tamper resistant box can be coupled to container 110 via brackets 112, 114, 116, 118. The set of detectors may also include detectors capable of detecting attacks against the tamper resistant box. Generally, the various detectors discussed herein are known in the art, so not disclosed in detail herein.
The phrase “tamper resistant”, as used herein, refers to a structure that has been hardened against tampering, including reverse engineering, to the extent possible under the state of the art of relevant technologies. Such technologies can include physical measures and detection means, including electrical, magnetic, infrared, logical or other sensory means of protection or detection as well as software methods. The resistance to tampering can be increased by various strategies for deploying the nodes using the Secure Network. “Tamper evident” is considered to fall within the scope of the “tamper proof” or “tamper resistant” concept, in that the tamper resistant box may include means for detecting attempts by an enemy to tamper with it. Ideally, the tamper resistant box will detect tampering before the enemy realizes that the detection has been made. In this case, the box can also act as a decoy. Tamper proof refers to an ideal which, theoretically at least, is unattainable, thus use of “tamper resistant” is generally more accurate.
A robot 130 may optionally be included, and can take the form of a portable computer platform. The robot 130 could, for instance, take the form of a handheld device, remote controlled device, or pre-programmed mobile device. When included, the robot 130 forms part of the Secure Network and is configured as a monitor node. Accordingly, the robot 130 can perform auditing activity, such as counting and identifying containers that either do or do not contain remote nodes. For example, a robot could be deployed before entry and/or exit of a port.
As a node in the Secure Network, robot 130 executes an intelligent agent that configures the robot as a node capable of auditing other nodes in the Secure Network. In a wireless setting, robot 130 includes a wireless communication interface to enable communication with other wireless nodes in the Secure Network.
Like the remote nodes 102, 104, 106, 108, a robot 130 can be enclosed in its own tamper resistant box. In such a form, robot 130 includes detectors suitable for detecting attacks against its own tamper resistant box.
A monitor (or monitor node) 120 forms part of the Secure Network. Monitor node 120 includes a computer processor and storage, and is configured to host and run an intelligent agent capable of configuring the monitor, including installing any downloaded software and files. In the wireless setting, monitor 120 includes a wireless communication interface that enables it to communicate with various servers (e.g., server 140), other monitors, robots (e.g., robot 130) and remote nodes to perform auditing of the Secure Network.
The monitor node 120 may also be configured to detect suspicious activities directed against it. As with the robot and remote nodes, the monitor node 120 may also be enclosed in its own tamper resistant box. If housed within a tamper resistant box, monitor node 120 may also be configured to couple to detectors capable of detecting attacks against the tamper resistant box. Unlike remote nodes 102, 104, 106, 108, the monitor node 120 does not directly couple to container detectors, unless required as part of its auditing function. Rather, the monitor node 120 provides an auditing function with respect to the remote nodes 102, 104, 106, 108 themselves, and can also be configured to audit other nodes within the Secure Network. Therefore, the monitor node 120 can receive and process data from remote nodes indicating an illegal condition or attempt to compromise the Secure Network.
Secure Network server 140 is a computer, possibly located inside a secure United States government facility or a security management facility, which provides overall management of the Secure Network. The Secure Network server 140 is configured to generate software and data files, including initial encryption keys, for each remote node and monitor node. The software and data files (and encryption keys) are specifically generated for each node. Each node can be given an IP address, which provides a means for the Secure Network server 140 to access the nodes via, for example, the Internet and to distribute the corresponding intelligent agent modules (or agents), software and files to each node. For a given node, the agent installs the software and files, allowing the node to enter the Secure Network. In the event that the Secure Network server 140 is housed within a tamper resistant box, then the Secure Network server may also include detectors capable of detecting attacks against the tamper resistant box.
In the preferred embodiment, the present invention enables an “active defense”. An “active defense” presumably goes beyond preventing an act that is already underway but either prevents other attacks from occurring or at least identifies a specific attack very early on, before the enemy knows it has been discovered. An active defense contemplates the possibility of capturing or destroying the attackers, including persons who are planning or managing the attack. Monitoring attempts to attack Secure Network nodes provides an active defense.
As is shown in FIG. 2, a plurality of, if not all, shipping containers on a single vessel could include some number of remote nodes. The presence of one or more remote nodes in each container being shipped in a vessel could be made a condition for that vessel entering US Ports (e.g., where the vessel is a ship) or crossing a US border (e.g., where the container is being transported on a truck body or by rail). In FIG. 2, eight containers are shown loaded on a vessel 200. For a first set of containers, container 202 includes remote nodes A-D, container 204 includes remote nodes E-H, container 206 includes remote nodes I-L, and container 208 includes nodes M-P. For a second set of containers, container 212 includes remote nodes Q-T, container 214 includes remote nodes U-X, container 216 includes remote nodes Y-BB, and container 218 includes nodes CC-FF.
The containers can be examined efficiently by the onboard monitor 220 through communication with the remote nodes of each container, while the container is in transit from the foreign point of origin. Such monitoring can determine if any of the containers are storing suspicious materials or are the target of suspicious activities. The remote nodes report to and can be queried by either monitors or servers. The communication path between a remote node and monitor 220 can be direct or via other remote nodes. And the path between remote nodes and server 240 can be direct or via other nodes.
For example, path 222 shows that remote node B can communicate with monitor node 220 via remote nodes E-F-H-N-P. This path can be continued to server 240 via path 242, thereby establishing a path between remote node B and server 240, via remote nodes E-F-H-N-P and monitor 220. Of course, path 242 could also represent communications between monitor 220 and server 240, independent of communications from any remote nodes. Other paths may also be formed for remote node B to communicate with monitor 220. As an example of direct communications, remote node DD is shown communicating directly with monitor 220 via path 224. FIG. 2 also illustrates how a remote node can communicate directly with a server, here remote node FF communicates directly with server 240 via path 244.
FIG. 3 shows yet another configuration of containers on vessel 200. This is a stacked configuration. In a stacked configuration, it can be difficult to maintain a wireless path between each remote node and the monitor node 220, server node 240 and, if provided, a robot (not shown). Also, there may be instances where not every container in the stack includes a remote node. For instance, in FIG. 3, container 210 does not include a remote node. As an example, a communication path between remote node K of container 206 would likely not be a direct path, since container 206 is buried in the stack. Therefore, the path may have to go through other intermediate remote nodes, while avoiding container 210. Accordingly the path between remote node K and monitor node 220 include nodes L-J-S-T-AA-BB. Other paths could also be formed. To communicate with server 240, the path may also include path 246 between monitor 220 and server 240.
Through querying various remote nodes of containers, containers that do not contain remote nodes can be readily identified by monitor 220 or a robot prior to the ship arriving at its port (e.g., a US port) or the truck or train arriving at a border (e.g., a US border). Shipping containers loaded on a ship can be examined while loading through an intermediary of a monitor 220 and after loading through the intermediary of a robot.
The present invention addresses the problem of inserting detection devices into shipping containers in such a way that a determined, sophisticated enemy cannot defeat the system. In the foregoing figures, detectors and remote nodes are provided at the container. However, no doubt, there will a number of potential strategies for defeating the insertion of detectors and nodes which detect suspicious materials and activities as described above. Such potential enemy strategies may include:
    • 1. Shield the suspicious materials or activities from the detectors.
    • 2. Defeat the communication interface so that the interface does not report evidence of suspicious materials or activities reported by the detectors.
    • 3. Disconnect the detecting devices from the interface.
    • 4. Surreptitiously load a container that contains an atomic weapon but that does not contain detecting devices onto a container ship.
    • 5. Overcome the monitors so that they incorrectly report on the status of the devices.
The difficult aspect of the environment is that the detectors, nodes and the communications interface will be in the hands of the potential enemy for some period of time, at least for the period of time necessary to load the container. Also, since the potential enemy is presumed capable of constructing an atomic weapon, the enemy must be presumed able to utilize other advanced technologies suitable for defeating the detectors, remote nodes and interface. Also, if the enemy is conspiring with a disloyal employee of the shipping company, the monitors and the robots could fall into enemy hands.
Of course, there are some advantages potentially available to the side providing the detectors, remote nodes and interface (i.e., the defenders). For example, potential strategies and advantages for defenders include:
    • 1. Defenders can limit the time the detectors, remote nodes and the interface are in the hands of the enemy, thereby limiting the time available to reverse engineer the detectors or the nodes.
    • 2. Defenders will understand the defensive systems better than the enemy. Defenders can maximize this advantage by making the defensive terrain more difficult to understand, and by not repeating the same defensive terrain. This means that reverse engineering one interface will not necessarily be helpful for reverse engineering the next.
    • 3. Defenders can maintain important parts of the system physically secure from the adversary.
    • 4. Defenders can harden the physical protection around the interface.
    • 5. Defenders can use detecting devices which detect not only suspicious material but also attacks against the communication interface.
    • 6. Defenders can use multiple communications interfaces and detectors, which can continuously monitor one another, so that if one is attacked one of the others can report the attack or shut the system down.
    • 7. Defenders have many opportunities to test the system.
    • 8. Defenders have many opportunities to employ robots which can be externally controlled from remote secure locations.
    • 9. Defenders have the ability to continuously monitor each remote node from the moment a shipper begins loading the container until the container arrives at its final destination.
    • 10. Defenders have the opportunity to mount an active defense such that an enemy can be detected before the enemy realizes it has been detected, thereby allowing the defenders to perform to covert surveillance of the enemy's infrastructure.
    • 11. Defenders can implement orthogonality to significantly reduce the possibility of imposters gaining access to containers, detectors, remote nodes, monitors, or robots.
    • 12. Defenders can use a secure stage during which they can configure the battle terrain to the defenders' advantage.
A secure detection system network in accordance with the present invention is particularly suited to maximizing these advantages for the defenders. The capabilities provided by such a system which are relevant to maximizing the above strategic advantages for the defenders are discussed below.
Generating network components, rapidly installing these components, and auditing the components immediately after installation provides a great deal of security. This generation/installation/audit capability can be utilized to limit the time a remote node is in the hands of an adversary, since this process is so highly automated, and the ability to dynamically configure the remote node presents unknown terrain to a potential attacker.
Strobed encryption allows for exchanging encryption keys every few seconds between nodes in the Secure Network. This capability can be exploited by constructing a system of nodes so that they can all strobe with one another and each can check on whether the other is being attacked. This makes reverse engineering more difficult because the target is continuously changing encryption keys. In this context, if the information is communicated outside to monitor nodes, information previously sent, even if it could be decrypted, is almost useless to a potential enemy. So, breaking one key does not help break the next. The time advantage between detection of an attack and an enemy's realization that detection has occurred represents an opportunity to mount a defense aimed at penetrating an enemy's infrastructure.
The Secure Network can be used to rapidly configure ad hoc networks such that several remote nodes inside a container can be securely linked to one another and to other nodes such as, (a) to a shipboard monitor which will monitor the remote nodes in all of the containers on board, (b) to possibly a monitor which will communicate with the remote nodes while the container is being loaded by the adversary, (c) to possibly nodes in other containers, and (d) to possibly a robot which will count the containers before the ship is ready to leave port.
One possible application of this embodiment of the present invention is discussed below. We will assume the following organizations are involved: (a) a US Coast Guard Control organization located in the United States in a secure location; (b) a shipping company, located in a foreign country, which is known to and certified by the Coast Guard; and (c) a shipper (or seller/distributor) who will load the container with merchandise (or cargo). We assume that the shipper is hostile. We assume that the shipping company is disposed to be cooperative, that is, the shipping company is a substantial, recognized business which has a strong financial incentive to prevent a nuclear attack on the United States perpetrated through the intermediary of one of its containers. However, we may assume that the shipping company has some disloyal employees who personally are hostile to the United States.
We will assume a requirement that a container that does not contain an approved secure detection system is not allowed to enter the United States. Shipping companies who refuse to comply would not be allowed to ship containers into the United States, whether through US ports or across US borders. Shipping companies who want to comply will register with the US Coast Guard for example. As a precondition of being allowed to register, they would agree to undergo a background check, the simplicity or intensity of which would vary company by company.
A description of how the system could operate under this scenario is as follows. The remote nodes and monitors are provided to shipping companies. The remote nodes and monitors are manufactured and delivered in a tamper-resistant state for installation in containers bound for the United States. The remote node could include the detectors within its tamper resistant box. The nodes could come in different classes, depending upon the type of detectors with which the remote node is configured to interface. The class, nature, type, quantity, and capabilities of the detectors configured to couple to a remote node should remain classified and known only to the server node.
The shipper orders one or more containers. For example, the shipper needs a container to ship a particular product to the United States. The shipper arranges with the shipping company for delivery of a container to the location where the shipper will load the container. The shipper and shipping company agree on details such as the size of container desired, when the container will be delivered, the contents of the container, when the container will be ready for pickup, destination, likely weight and so forth.
The shipping company enters an order with Coast Guard. The shipping company is registered with, for example, a container control system established by the Coast Guard. Using a computer and communicating via the Internet, the shipping company connects to the Secure Network server node and inputs the appropriate information regarding the request for a container received from the shipper.
The shipping company initializes remote nodes and monitors to be used by the shipper via the Secure Network server. For example, on the day the container is to be dispatched to the shipper, the shipping company assigns a separate IP address to each of some number of remote nodes, perhaps four, and a monitor node, and also assigns a receptacle number to each remote node assigned to the container.
The server node identifies the remote nodes that should be placed in the designated container based on the nature of the cargo to be shipped, the remote nodes known to be in the inventory of the shipping company, and other factors such as, perhaps, the reputation of the shipper, the country of origin, and so forth.
A shipping company employee then couples the remote nodes and monitor node to the Internet, enters the respective IP addresses and receptacle number for each remote node and requests initialization from the server.
The server generates software and data files necessary to securely network the remote nodes and one or more monitors with the server into a Secure Network, as previously discussed. Additional random procedures can be introduced into the software so that no two remote nodes or systems will appear identical to an enemy attempting to reverse engineer them. The server will also randomly generate initial keys for use when the remote nodes or monitors connect with one another via the Secure Network.
The server will query each of the remote nodes and monitors to check system integrity. The remote nodes and monitor will all have serial numbers in their processors, which previously will have been registered with the server. The server will then automatically download and install software on the remote nodes and monitors which are still in the shipping company's possession or control. When the installation is complete, the remote nodes and the monitors will connect to one another, and immediately begin strobing the encryption keys used between each pair to exchange messages. Strobing is discussed in detail in Appendix G.
The shipping company can perform an orthogonal audit, as more fully described in the Appendicies hereof. The installation can, for example, be orthogonally authenticated perhaps by the server's downloading a randomly generated number to be displayed on the screen of shipping company's office computer and then by placing a telephone call to shipping company's office and having the number on the screen entered through the telephone key pad.
The authentication is valid even if the shipping company employee supervising the installation is personally hostile to the United States or is working for an enemy. This auditing procedure is in conformity with the methods disclosed to audit a node after installation in the Secure Network.
The shipping company installs remote nodes in the container, preferably in numbered, tamper resistant receptacles, perhaps in the four diagonal comers of the container, and delivers the container to the shipper. It would be appropriate to perform another auditing procedure when the remote nodes have been inserted into their appropriate receptacles. The four remote nodes will continue to send messages to one another and to strobe encryption keys with one another. The remote nodes optimally will also remain in contact with a monitor, which can remain in the shipping company's control, and which will remain in contact with the server.
An optimal configuration would enable any remote nodes to detect attempts to tamper with it or to remove it from the receptacle into which it has been placed. Any suspected tampering could be detected by the remote node and communicated to other remote nodes or to the monitor or monitors to which the remote nodes are connected.
The shipping company then delivers the container to the shipper. The remote nodes and detectors are installed and the remote nodes continue communicating with one another and with a monitor in the shipping company office. The remote nodes should remain connected to a power source. If they are disconnected from the power source this will represent a system violation. As an example, the remote nodes could use some type of a rechargeable battery. Containers provided with power sources have been used in global commerce for many years. These power sources could also provide power for remote nodes.
The shipper loads the cargo into the container. This is a vulnerable situation because the remote nodes are potentially under the control of the enemy at this time and must withstand attacks designed to destroy, deceive, or reverse engineer them. However, if any remote node can detect tampering, it will communicate with the monitor and could be shut down. If tampering is detected, the container will preferably not be loaded on the ship without human inspection, and the matter should escalate so that appropriate police, military, and forensic activities can be initiated with the objective of capturing and prosecuting the persons who performed the tampering.
However, if the tampering can be detected without the shipper being aware that it has been detected, additional measures may be appropriate, namely the provision of additional surveillance and intelligence resources at the site where the container is being loaded and conceivably at the site where the ship will be loaded and at the offices of the shipping company. This would represent an active defense strategy.
Depending on cost and available technology, it would be possible to install various scanning devices in the remote nodes so that the loading of the container could be viewed and monitored. These devices could be important sources of intelligence.
Once the container has been loaded and locked by the shipper, it will be picked up by the shipping company, delivered to the port of departure and then loaded onto the ship.
Prior to loading, the monitor will communicate with the remote nodes in the container, and verify (a) that the remote nodes are in place and have not been tampered with and (b) that they have not detected suspicious materials or suspicious activities. Software on the monitor can also compare the weight of the presumed cargo of the container, and the actual weight of the container. Containers that exceed their expected weights by some predetermined amount will be subject to opening and visual inspection.
If included, a robot can be tasked to examine the ship before departure. After the ship is loaded and immediately before departure the robot will traverse the ship to inspect each object that could be a container, and verify that each such object is a container equipped with appropriate remote nodes.
The purpose of the robot is to avoid a situation where terrorists, working in concert with port employees and/or employees of the shipper, somehow smuggle an additional rogue container on board. Since this rogue container would not have any remote nodes inside, there would be no way for the monitor to know it is on board or what is inside it.
Prior to departure, the shipping company can install the monitor node in a tamper-resistant holder on the ship. The monitor will communicate with at least one remote node in each container and remain in contact with each container throughout the voyage to the United States. At the same time, the monitor onboard the ship will communicate with the robot (if any), and obtain a count of the number of containers on the ship and a report as to the existence of any containers on the ship that lack remote nodes. Containers lacking remote nodes can be unloaded from the ship and refused shipment until they have been opened and inspected by the shipping company and the port authority. If they are determined to be legitimate containers, the shipping company will install properly authenticated remote nodes before permitting the containers to be sealed and shipped.
After performing the inspection, the robot can be removed from the ship, reinitialized, and be used to inspect the containers on another ship.
A robot can also be used to examine a ship before entry into a US port. When the ship reaches the US port, the Coast Guard will be able to communicate with the monitor on board the ship and will be able to verify that the ship is composed entirely of containers with remote nodes and that no sensor has detected improper materials. The robot could also re-examine the ship to determine that all containers have remote nodes, that is, that a rogue container has not been loaded on board during the voyage.
One method might be to have a robot that remains on board the ship. The robot could be reinitialized automatically and could perform its inspection without the ship having to be boarded by the Coast Guard. A second method is for the Coast Guard to board the ship and bring a robot with them. The robot would be initialized as a node and authenticated when it was on board the ship.
A shipping company could already have appropriate robots or controls on board so that the functions performed by an robot could be performed by controls already on board the ship. In this case, it would be appropriate to integrate the monitor with on board system controls in an appropriately secure manner.
If any remote nodes have found suspicious materials, the corresponding containers would need to be inspected. Containers without remote nodes, or with remote nodes that have ceased to function, will need to be inspected.
In cases where a ship uses holds to store loose cargo, one or more remote nodes could be placed inside such holds. The hold could be treated as a container. The hold is typically bigger than a container, although individual items of cargo in the hold are usually smaller than items loaded into a container, and, therefore, would generally be less capable of providing shielding against detection of suspicious materials.
Containers seeking to enter the US by truck or by rail can be held to the same requirements. That is, they could be required to contain remote nodes which could be examined by a monitor prior to being permitted US entry.
The remote nodes can be manufactured and shipped to include detectors in their tamper resistant containers. What detectors are actually located in a specific remote node should remain highly classified, since that information would aid those interested in defeating the nodes. The detectors that are introduced into any specific container should depend on the cargo that the shippers claim will be shipped. The decision as to which remote nodes should be installed into a container should be made by the server based on information which only it has.
Given a specific set of detectors in a remote node, the values which the detectors will look for should be dynamically configured by the server immediately before the container is shipped. This is essentially an arms race, wherein as the enemy becomes more sophisticated in ways of shielding bombs the detectors are improved to overcome the shielding. It is assumed that whatever the current state of detection and shield technology, that detection can be improved by getting detectors inside the container. Also, deploying an inside-the-container detection system provides an additional layer of protection that augments and backs up whatever detection is possible from satellites or other out-of-the-container scanning methods.
To the extent that these detectors could be mounted on chips and built into a circuit board, more detectors could be deployed more inexpensively. Indeed, there is some discussion in the literature as to the need for scanning large areas of the earth with broad area passive sensors and then focusing on potential targets with narrowly focused active sensors. Presumably, if one could get close enough to the potential target, the need for broad area sensors would be lessened and the detecting ability of more narrowly focused sensors would be greater.
For example, considerable protection could be achieved if each remote node contained one or more Geiger counters and/or other detectors and possibly a way of detecting if the remote node were moved from its brackets. Just beating this system would require time and design on the part of potential enemies. Buying time is important because in the meanwhile perhaps the bomb manufacturing plant could be discovered and destroyed. Perhaps better sensors could be developed which could then defeat any improved shielding the enemy had developed. In any event, the Secure Network provides a significantly higher degree of security than might otherwise be available
One of the strategies of the secure detection system is to limit the ability of the enemy to experiment with the detectors. A second, somewhat related strategy, is to detect an attack on the remote nodes before the enemy knows that it has been detected, thereby pinpointing the existence and location of enemy facilities. It is possible using a system that includes the Secure Network with detectors to detect attempted enemy attack before the enemy knows that his attack is detected. This actually represents an active defense.
Detecting an enemy attack before the enemy is aware that the attack has been detected has many important possibilities, such as militarily raiding the location where the container is being loaded, adding additional intelligence gathering capability to that particular site and so forth. Of course a shipper who attempts to attack a remote node or to surreptitiously ship weapons should not again be allowed to ship containers to the United States.
The detecting strategy can be improved to correspond to the cargo which the shipper claims will be present. The system proposed in this invention is particularly well suited to dynamically modifying the detection strategy to suit the proposed cargo. In the first place, the decision as which remote nodes are selected to be included in the container can be dynamically made, by the server, at the moment the remote nodes are prepared for subsequent insertion in the container. Secondly, the detection strategy that will be used by the remote nodes, given a specific set of detectors, can be dynamically configured at this moment. The selection of the remote nodes and detectors, and the configuration of the detection strategies, can be made on the basis of information available only to the server.
Certain cargoes might be of such a nature that it would be impossible to determine whether a bomb was hidden inside, in which case these cargoes would require manual inspection. Examples of such cargoes could be the legitimate shipment of nuclear materials or legitimate shipment of nuclear shielding materials.
It is also potentially important to assure that the detectors remain located at both ends of the container rather than, say, being moved to one corner. But, this can be a function of the detectors' range and density of the cargo loaded in the container. The detectors may be located in the same box as the remote nodes, or in other embodiments detectors could external to whatever box holds the remote nodes. There are a variety of methods of determining where the remote nodes are in the container and also of detecting any attempts to relocate them while under the control of the shipper. However, it is important to detect movement of the remote nodes from their original position. In the first place, movement of the detectors can be evidence of an attempt to attack the remote nodes, particularly when they are in the same tamper resistant box. Secondly, movement of the remote nodes may impair the ability of any enclosed detectors to detect suspicious materials.
The present invention is structured so that actions taken by human beings can be independently verified by other means. Since the system does not rely on any human action that cannot be separately verified it can therefore be orthogonally secure.
While the foregoing has described what are considered to be the best mode and/or other preferred embodiments, it is understood that various modifications may be made therein and that the invention or inventions may be implemented in various forms and embodiments, and that they may be applied in numerous applications, only some of which have been described herein. As used herein, the terms “includes” and “including” mean without limitation. It is intended by the following claims to claim any and all modifications and variations that fall within the true scope of the inventive concepts.
Appendix A Secure Network & System Overview
A Secure Network in accordance with the present invention is composed of nodes, which can be objects that run as threads and which are capable of securely connecting to other nodes and of interfacing to a wide variety of other computer executables and libraries running on Windows or UNIX.
Strobed encryption is the procedure for dynamically changing encryption keys every 30 to 60 seconds, for example. The details of one implementation of strobed encryption are provided in Appendix G. The parties begin with randomly generated startup or initial keys, which are hidden from everyone, including the parties themselves. By contrast, key exchange protocols such as EKE or kerberos, start with only a remembered password and have no mechanism for changing keys during a particular session. Strobed encryption in accordance with the present invention depends on other technologies of the Secure Network, such as automatic network generation, automatic installation, orthogonal authentication (see Appendix B) and audit, and data packaging (see Appendix C). The Secure Network uses only encryption primitives that are public, standard, and tested. New encryption primitives can be added as they become available.
Packaging, as used in the Secure Network, is an object-oriented framework for creating and compressing packages suitable for use over TCP/IP. The packaging framework include an Item class, which allows derived objects to model virtual any data format, and to apply compression on a field by field basis. Items and packages can be inserted into and extracted from packages and packages can be inserted into warehouses, which are disk resident files. The Secure Network uses its packaging methodology for general data transport and for storage and transport of encryption keys.
The Secure Network has a network generation program, which automatically generates configuration information needed to install a node. This program randomly generates the startup keys for all nodes. These keys will strobe immediately after the first connection. The network generation program also builds the executables and dynamically embeds randomly generated keys into the executables. See Appendix D.
The Secure Network has an installation procedure which permits automatic installation of an entire network or parts of a network and allows for orthogonal audit and authentication of every network node, discussed in Appendix E.
Nodes in the Secure Network connect to other nodes using TCP/IP. Nodes can directly connect to some arbitrary number of nodes. By connecting nodes going through intermediate hops, an arbitrarily large Secure Network can be constructed. As an example, the node can be modeled in C++ as a class derived from an node thread class. The node class is inserted into an executable or a COM object by means of a pointer. The node class has an embedded package, and this package contains the information generated by the generator which allows the node to connect to other nodes.
The process that manages a node can do other things. For example, database servers can be nodes. A process that runs a browser can be a node. Intermediary routers that are used in a massive Secure Network can be nodes. (See Appendix F). The network diagram of the massively scalable Secure Network (see FIG. 4) shows some 27 different nodes. Each node has a different number, which is located in the lower right hand corner of the box on the diagram.
The server has a generator program, which, using a template, supplies all of the values needed for the various nodes in a Secure Network to connect to one another. The formal, exact definition of a node is that a node is an object created by the generator, which has the characteristic of being able to connect to other nodes. To define the relationship between a process and a node, at least one process is required to manage a node. Although, a process could manage more than one node.
There appear to be three unstated implicit assumptions in the present security system practice and the current security literature that are not followed in the Secure Network system. These assumptions are (1) that one cannot look to verify the identity of the other side; (2) that one cannot frequently reinstall the network; and (3) that one cannot frequently rebuild the network or the software. It would appear that these assumption have constrained approaches to the security problem so as to make the solution more, rather than less, difficult. Usually, of course, constraining a problem leads more readily to a solution, but in this case it appears to be the other way around.
Assumption One: No looking. The first assumption is that, when authenticating humans, one cannot go and “look” to see and verify the identity of the person at the other end of the connection. Using orthogonality the Secure Network system goes and “looks” (using biometrics, physical facilities, human audit, telephones, cross checking with other databases, and business procedures) to “see” that the person on the other end of the connection is actually who he/she claims to be.
Corollary to Assumption One: Only verify once per day. There appears to be a corollary to the “no looking” assumption, i.e. that once you have verified the person on the other side, it would be unseemly to verify her again, at least that same day. As we have indicated, Secure Network system is capable of (and interested in) verifying that person's identity many times per day.
Assumption Two: No reinstallations. Assumption two, which the Secure Network does not accept, is that installation is something that happened in the past and will not happen again for many months. Since the procedure can be automated and because it is easy to accomplish, the Secure Network is designed on the principle that critical applications will be installed and orthogonally authenticated frequently, e.g., every morning. The principles of the orthogonal authentication have been outlined herein, as have the principles of automatic installation.
It may be argued that reinstalling critical applications would overtax corporate computing resources. However, a large organization typically will have most of its employees working during a single daytime shift, and it will have computers available to support that work during that shift. During off-shift hours, under this assumption, unused computing resources are idle. The Secure Network can install a crucial application in a few seconds, so there is no significant impact to a large network.
It may be argued that daily reinstallation would be expensive. However, automatic reinstallation every morning saves organizations time and money. Conversely, manual installation is an inconvenient, time consuming, expensive, insecure, and error prone process. A new manual installation is usually required for each new client for a major system. A manual installation might cost, for example, $10,000 for a system installed in a foreign country. By assuming that all critical systems will always be automatically installed, a company would eliminate ever doing a manual installation, and thereby avoid the costs of manual installations.
Another important aspect of machine generated automatic installation of applications is that it takes installation out of the hands of system administrators, who, if they are corrupt, may install software which is not allowed. While reinstalling, the Secure Network installation procedure will destroy possibly infected examples of its own software. While reinstalling, the Secure Network will check for other examples of unauthorized software.
Assumption Three: No rebuilding. A final assumption, not accepted by the Secure Network, is that the code build and network configuration is something which happened in the past and will not happen again for many months. If frequently reinstalling, the software and network can be rebuilt at the same time. The advantage of rebuilding is that the Secure Network can randomly generate new keys and embed these keys in the executables. Also, the Secure Network can build new network connections, so can randomly generate keys for each connection, and randomly change IP addresses.
As long as rebuilding, it would be appropriate to check the source code for hidden back doors, and to verify that the source code has not changed.
One effect on system design of abandoning these assumptions, i.e., one cannot verify identity by “looking” and can not reinstall or rebuild executables and networks daily, is that there is no need for digital certificates. By eliminating these assumptions, the Secure Network is able to provide each node pair with starting session keys and one-time pads in each direction. A one-time pad is advantageous because it requires only an XOR to encrypt, which means that encryption is very fast. After the initial startup, the Secure Network immediately changes all of these keys through strobed encryption.
Appendix B Orthogonal Authentication
Orthogonal authentication as implemented within the context of the Secure Network strengthens security by requiring multiple inputs from unrelated sources as a constant check on security decisions. Orthogonal authentication also eliminates the need for digital certificates and extends security procedures into the machine layer so as to mitigate the potential failings of human guards.
As an example, the problem that digital certificates are designed to solve is to determine whether the person on the other end of the connection is Alice or some imposter such as Eve. Assume that Alice is a person with sufficient authority to access computer networks that would enable her, if she were so inclined, to perform some devastating action, such as crashing a NASA mission, siphoning off enough money to put a bank out of business, releasing nuclear materials to terrorists or loading weapons of mass destruction into a container. If we know Alice well, and we do want to know Alice well or else we will not admit her to our network, we find that she has many characteristics that can be verified. Alice works somewhere, for example in Building 302 in Acme Complex in Anytown, AnyCountry. Assume that Acme Complex has installed a facial scanner at the building entrance. If Alice has not successfully passed through the facial scanner in Building 302 today, or if she has already left the building, a person on the other end of the connection seeking access is not Alice.
Further assume that Alice works in Room 412, and that there is a hand geometry scanner at the entrance to this room. If Alice has not successfully passed through the hand scanner in Room 412, the person on the other end of the connection is not Alice.
Further assume that Alice has a specific workstation in Room 412, and that she has a fingerprint scanner on her desk. If Alice's fingerprint has not successfully passed that fingerprint scanner, the person on the other end of the connection is not Alice.
Further assume that Alice has a telephone on her desk. If we call that number, and no one answers, or the person who answers does not pass a voice print scan, we can say that the person requesting access to our system is not Alice.
Further assume that Alice has a supervisor named Bob. If we contact Bob to verify that the person at Alice's desk is Alice, and he fails to do so within some period of time, we may conclude that the person at the other end of the connection is not Alice.
We can call Alice at various times during the day, and have Bob audit her to determine that the person at the other end of the line is still Alice. Also, we can be notified by the hand scanner when Alice leaves Room 412 and by the facial scanner when Alice leaves the building. We can even require Alice to put her finger in the fingerprint scanner every few hours. So we have a variety of strategies to verify that it is still Alice who is at the other end of the connection.
These strategies are “orthogonal” in the sense that, for Eve to be accepted as Alice, Eve will have to beat multiple unrelated systems and corrupt unrelated people. All of these strategies are more powerful and reliable than the fact that at some point in the past Alice has been issued a digital certificate. First, the fact that a digital certificate is properly presented does not conclusively prove that Alice is at the other side of the connection. The certificate could be stolen or phony or someone else could be sitting at the computer where the certificate was installed.
Second, digital certificates can be stolen. Third, if someone can steal the secret key, the digital certificate can be remanufactured at will. Since the key can be stolen through copying, the theft of the key may not be detected for months. Fourth, a digital certificate has a lifetime and therefore a vulnerability of approximately six months, during which time it could be stolen or broken. A security device with a long period of vulnerability is not an optimal situation. For example, the digital certificate has such a long lifetime that a terrorist could defeat the digital certificate in some way and still have time to defeat another system such as a biometric device. Fifth, digital certificates are often issued by third party authorities, which means the organization has to rely on the security of a third party it does not control.
With the exception of Bob's audit of Alice, the orthogonal authentication procedures do not depend upon on-the-spot decisions made by human beings. The procedures described above will work as well at 4:00 pm in the afternoon, when humans become tired, as they worked at 8:00 am in the morning, when humans are alert. The procedures will work the same way whether Alice is a clerk or is the CEO. Bob is primarily called upon to perform the audit. His only “decision” is determine whether the person sitting at the desk is Alice or not Alice.
Appendix C Data Packaging
The Secure Network system sends Secure Network packages directly over TCP/IP. A package is an object which will turn itself into a stream and unpack itself from a stream. A stream is a set of bits that can be sent over TCP/IP. The Secure Network packaging software also contains an Item class. Objects derived from the Item class can model any data format. Items can be inserted into and extracted from packages. Through the use of virtual functions, a package can insert and extract a derived Item which it has never seen before.
The advantage of the Item class is that one can develop specific data formats for specific purposes, and also that compression can be applied at the Item level for data that is highly repetitive. Items can contain longs, integers, bytes, bits, strings, and streams. Packages can be inserted into and extracted from packages. Packages have their own compression methods. Keys are typically generated inside Items as streams; items are inserted into packages, the package is compressed, and then encrypted with another key. No keys are stored in the clear. Keys are generally not stored on disk, and certainly not on the same disk where the files they encrypt are located.
The Secure Network can contain warehouses. A warehouse is a file into which packages can be inserted and extracted. Packages are always compressed and usually encrypted. Warehouses permit fast searches for packages.
The compression ratio for a package depends on the type of data that is inserted. Keys and random numbers are changed but not made smaller after compression. Certain other types of data can be compressed up to 10 times. Packages are also used to send application data and for key strobing. Any data loss or alteration will render the entire package unusable and unrecoverable and therefore immediately noticeable.
Appendix D Network Generation
The Secure Network generator generates all of the executables and data files necessary to start a process at a particular IP address, and usually executed on the Secure Network server. Most of the data files are Secure Network warehouses, which store packages encrypted with a hard key, just randomly generated, which is embedded within the executables.
The Secure Network generator generates network parts from a template. The generator is critical for implementing strobed encryption and for extending the Secure Network system back through system design, testing and build. By putting the template and the generator under orthogonal audit control, control over who can design, build, test, and install a given network and who approves the design is possible. As part of each build, the source code is checked for network calls other than through the Secure Network API and for hidden back doors by other methods.
By generating network parts immediately before the node is installed, the Secure Network can provide start up keys that are only minutes old. If 10,000 employees in a large facility were due to access the computer facilities at 8:00 AM, a portion of the network generation might occur half an hour earlier. The last operation to occur would be the generation of the startup keys, which could be arranged to be within minutes rather than hours of the time a node was downloaded and installed.
Appendix E Network Installation
Network installation means delivery of software and data files to a particular computer, starting a process to manage each Secure Network node on that computer, and providing some type of orthogonal authentication when the nodes have begun to connect. Nodes know all of the other nodes to which they are allowed to connect. When a node is started by a process, it automatically connects with all other allowable nodes with which it can establish a TCP/IP connection, and immediately begins strobing encryption keys. A node has available to it an initial set of encryption keys for each allowable connection.
Under the preferred installation procedure, the generator delivers the node files to an Secure Network database, and then creates a self-executing file called an intelligent agent. The intelligent agent is downloaded to a target site or device. When it is run, it knows how to connect to the database, and downloads and installs the files from the Secure Network database. This has a number of advantages. One advantage is that only the agent knows how to find the installation database. This is a prevention against denial of service attacks. It is difficult to conduct a denial of service attack against a database which is hidden. Secondly, this design facilitates a single installation at a known site. The agent knows where it is supposed to be, and if it is not where it is supposed to be, will not work at all. The database knows that a given agent is allowed to install only once, so if the same agent tries to install twice, something is wrong. This use of the agent might alleviate the need to telephone a password to the target site, although perhaps it is not a bad idea to add this embellishment anyway.
Other safeguards are programmed into the Secure Network node that is the target site. A Secure Network node listens on a port/IP address which has been randomly generated seconds before the installation and which is never made public; the node only accepts one connection to any other node; it knows what it is supposed to be listening for and can determine a fraudulent connection immediately if the IP address is wrong and after a single packet exchange, if the keys are wrong.
If a package is not correct (it cannot be decrypted, or after decryption, it cannot be inflated, or the check digit is wrong, or it cannot be unpacked), the package is rejected, and after a small number of such packages, the connection is closed.
If, despite these precautions, an intelligent agent were to be stolen, and installed fraudulently and it managed to connect successfully to the Secure Network server, the problem would become immediately apparent, if the installation needs to be orthogonally audited before any data is permitted to pass over the new connection. Also, when the real node attempted to install, the problem would again be obvious because the Secure Network permits only one connection between nodes. The optimal procedure is to generate the software for a node, install the node, and audit it within a matter of minutes.
From the point of view of an employee, this procedure might be as follows: the employee enters the building, passing through a biometric device such as a facial scanner or hand scanner; the employee enters his or her work area, passing through another biometric device. The employee turns on his or her computer, and uses a finger print scanner located on his or her desk. A minute later the telephone rings and the employee answers it. The computer then admits the employee to the applications on the network he or she is authorized to use.
Appendix F Massively Scalable Secure Network
The Secure Network can connect two nodes or dozens of nodes, or even thousands of nodes. A portion of a massively scalable Secure Network architecture is shown below in FIG. 4. Under the architecture, the Secure Network has two parts. One side is used for strobing and the other side for sending application data. The top level node, node 1, controls which side is used for strobing and which side is used for sending data. After a strobe on one side is completed, and after waiting for some amount of time, node 1 sends messages so that the side previously used for strobing is now used to send data, and the side previously used to send data is now used for strobing. The amount of time after completion of a strobe on one side is dynamically configurable and can be used to control the amount of resources used by the system.
Under this architecture, any two nodes can be directly connected; otherwise nodes connect to nodes by going through various intermediary hops. The design possibilities are very flexible. As a package passes through the hops, it is protected by end-to-end strobed encryption, in which the keys strobe between the node at which the package originated and the node that is its destination.
Application nodes have been arbitrarily numbered in a sequences beginning with 32261 and 65441 in order to illustrate a hypothetical network of approximately 10,000 application nodes. Nodes at indenture levels 0 though 4, that is all nodes with numbers less than 9999, are router nodes. The system has two separate networks of router nodes, a system with positive numbers and a system with negative numbers. Nodes at indenture level five can communicate by sending packages through either side of the network. Nodes can also be directly connected with one another. For example, 32262 directly connects with 65447.
Appendix G Strobed Encryption
Strobed encryption is a proprietary protocol which changes both asymmetric and symmetric keys periodically. A strobe occurs at the moment a connection is made and then periodically thereafter.
The First Exchange
The first strobing exchange starts with a set of keys that are present on network installation. Network keys and all files and software needed to connect to nodes are generated automatically by the Secure Network generator and downloaded through one of the Secure Network installation methods.
For example, suppose that we want to connect node A and B under the Secure Network. Go through the following steps.
    • 1. Generate the software and software files necessary to connect A and B, including symmetric keys needed to encrypt data between A and B. At the present time, use a 448 bit Blowfish key and a one-time pad of 2000 or more bytes. The generator randomly generates two sets of keys, one set for each direction, for each connection.
    • 2. Download the software to the computers on which A and B are to be located. (For this example we are assuming that A and B are to be located on different computers). There are several ways of doing this, as explained below.
    • 3. Start the process managing the connection. The nodes will automatically connect when the other side comes up assuming that the two processes are connected via TCP/IP.
    • 4. The two connections will immediately strobe all encryption keys.
    • 5. Audit the connection.
    • 6. Continue to strobe every so often, maybe every 30 seconds.
The time between generating the network parts and the first connection could be only a few minutes. Immediately the node will be “audited ” by being orthogonally authenticated in some way. If someone in the minute or so between the generation of the A/B connection parts and the real installation of A and B, could steal all of the parts to make the A connection, and could install A, and spoof the IP address, and could somehow connect to B, and do the first strobe, when it comes time for the actual A to connect, B will not connect a second time to A. It will become immediately obvious that something is wrong. The Secure Network is designed so that only one connection between two nodes is possible.
Details of One Example of Strobed Encryption
This is an example of strobing as currently implemented.
Notation:
[] is a compressed ANGEL package;
{}refers to a non-compressed ANGEL package.
(key) means encrypt what is to the right with key.
, a comma separates packages and items that have been inserted into a package.
Index means an item that usually appears at the front of the payload package.
A package is a C++ object which is capable of turning itself into a stream suitable for transport over TCP/IP and of recovering itself from a TCP/IP stream. The package is also a container into which other packages can be inserted and from which other packages can be extracted. Items can also be inserted into and extracted from packages. Extraction from and insertion into a package is only possible if the containing package is non-compressed. Compressed packages can be inserted into and extracted from non-compressed packages. An Item is a C++ object which, through derivation, can model any data format. Packages have their own compression methods. It is also possible to selectively compress data as the data is added to an item.
Initial keys are first generated. In the preferred implementation, the following initial keys are generated for encrypting packages sent between two sides of a TCP/IP connection. These keys are already installed either by the installation program or by the previous strobe. Strobing involves randomly generating and changing these keys. The initial keys include:
eout Blowfish 448 bit key to encrypt outbound packages
kout one-time pad (2000 or more bytes) to encrypt outbound packages
e in Blowfish 448 bit key to encrypt inbound packages
kin one-time pad (2000 or more bytes) to encrypt inbound packages
Package encryption is also used. The package actually sent over TCP/IP is referred to as the payload package. This package consists of an Index item plus some number of other packages and items.
The Strobe sequence is as follows:
State0
State0 is the initial state after two nodes have been installed.
Node A
(1) Create keys:
sA RSA secret key.
pA RSA public key.
(2) Prepare a payload package and send it to the other side:
kout(eout([Index,pA]))
This notation indicates that we have inserted Index, and pA into a payload package, which is compressed, and then encrypted first with eout and then with kout . We only use as much of kout as is necessary to XOR the payload package. If we used up kout before we have a chance to do another strobe, we are forced to commit the cryptographic sin of reusing some part of kout . However, we can avoid this problem by making kout large enough for potential needs.
Node B
Node B listens for a connection.
State1
Node A
Node A waits for a response from Node B.
Node B
(1) Extract pA from the incoming data stream.
Node B will decrypt the incoming stream with kin , then with ein , then inflate the package. The package will now be {Index, pA}, that is, it is a non-compressed package containing two objects, an Index object, the public key from Node A, pA.
kin and ein are identical to kout and eout used on the connect side. If this is the first strobe, this match up will be performed by the generator and the installation procedure. If this is an ongoing strobe, this match would have been performed by the previous strobe.
(2) Generate keys:
eB Blowfish 448 bit key
sB RSA secret key
pB RSA public key
kB One time key pad
(3) Make the payload package and send it to the other side.
kout ( eout ([Index,pA([eB,kBpB])]))
(4) Install new keys as follows:
eB as eout
kB as kin
State2
Node A
(1) Decrypt the incoming package with kin and ein, and extract pA([eB, kB, pB]).
    • Use sA to decrypt [eB, kB, pB]. Decompress and extract eB, kB, and pB.
(2) Generate keys:
eA 448 Blowfish key
kA A one-time pad
(3) Install
kA as kout
kB as kin
(4) Make and send the payload package to the accept side
kout(eout([Index,pB([eA,kA])]))
(4) Install
eB in ein
eA as eout
Node B
Node B waits for a response from Node A.
State3
Node A
Node A waits for a response from Node B.
Node B
(1) Decrypt and inflate the payload package and extract pB([eA, kA]).
(2) use sB to decrypt ([eA, kA]).
(3) Install:
kA as kout
eA as ein
(4) Send a notification message to Node A.
State4
Strobing is complete, and nodes A and B may now begin transmitting data to each other encrypted using their respective kout, kin, eout, ein keys.
Use of the One-time Pad
In one embodiment, the Secure Network system can send a one-time pad encrypted with other one-time pads and other session keys. If an enemy were to attempt a brute force attack on encrypted “text”, when the enemy had guessed the correct method of decryption, the enemy would realize that it had succeeded because the encrypted text would be plaintext and identifiable as such. However, applying a brute force attack to recover an encrypted one-time pad is more difficult because of the problem of distinguishing between a correctly and incorrectly decrypted one-time pad. The one-time pad is merely a sequence of random numbers. The “correctly decrypted one-time pad” can only be identified as correctly decrypted when it is applied to some cipher text and produces something recognizable as plaintext. Under the Secure Network system, the cipher text that can be used to identify a correctly decrypted one-time pad will not be sent until later, so at the very least a brute force attack cannot be successfully implemented against the one-time pad until the plaintext is sent.
The problem that the one-time pad must be as long as the message is real; however, we have methods for strobing the one-time pad on one channel while sending messages on the other. For continuous encryption there is a danger of running out of the old one-time pad before a new one arrives, he one-time pad cannot be reused. However, many applications do not require continuous encryption, and it you want to send a smaller amount of data, and you want to encrypt that data as fast as possible, a one-time pad is very rapid. For example, a radar looks at the sky and sees nothing for days at a time. Suddenly something appears.
It would be appropriate to use a one-time pad to transfer that small amount of critical data. Many applications, such as, for example, money transfer, send relatively tiny amounts of data interspersed with relatively large periods of inactivity. For these applications, there is a relatively small danger of running out of a one-time pad.
Of course, if the application does run out of the old one-time pad, in the time before the next one-time pad arrives, the application has to use other encryption methods and must not reuse the old one-time pad.

Claims (34)

1. A secure detection network system having a plurality of nodes, each node comprising a processor and storage means, the system comprising:
A. a plurality of remote nodes, each remote node comprising a set of detector interfaces configured to couple to a set of detectors disposed to detect the presence of an illegal asset within a shipping container;
B. at least one server node configured to initialize and install each remote node in the plurality of remote nodes, including delivering to each remote node an agent module, said agent module for each remote node comprising a node specific configuration file defining a set of nodes with which the remote node can communicate and a different encryption means corresponding to each node in the set of nodes;
C. a communication path coupling the plurality of remote nodes and the at least one server node; and
D. orthogonal authentication means for selectively restricting access to at least one of the plurality of remote nodes.
2. The system of claim 1 wherein the at least one server node includes a strobing module configured to selectively initiate coordinated strobing of the encryption means among the plurality of remote nodes.
3. The system of claim 1 wherein at least some of the plurality of remote nodes includes a wireless communication means, the communication path includes an air path.
4. The system of claim 1 wherein the at least one server node includes a wireless communication means, the communication path includes an air path.
5. The system of claim 1 wherein the at least one server node includes an audit module configured to selectively cause one or more of the remote nodes to terminate communication with at least one node in its set of nodes in response to one or more termination events.
6. The system of claim 5, wherein the one or more termination events includes detecting tampering with one or more remote nodes.
7. The system of claim 1, wherein the illegal assets includes one or more of chemical weapons, biological weapons or nuclear weapons.
8. The system of claim 1, wherein the illegal assets includes one or more of chemical agents, biological agents, radioactive materials, illegal drugs, or explosive materials or devices.
9. The system of claim 1, wherein one or more remote nodes from the plurality of remote nodes is disposed within a tamper resistant housing coupled to a shipping container.
10. The system of claim 1, comprising one or more subnetworks comprising a set of remote nodes from the plurality of remote nodes, and wherein each subnetwork provides a portion of the communication path.
11. The system of claim 1, further comprising:
E. a robot node, having a robot agent module and an interface to the communication path, the monitor node including means to query each of the plurality of remote nodes.
12. The system of claim 11, wherein the robot node is configured to query one of the plurality of remote nodes via a set of other remote nodes from the plurality of remote nodes.
13. The system of claim 1, further comprising:
E. a monitor node coupled to the communication path and configured to audit the plurality of remote nodes.
14. The system of claim 13, wherein the at least one monitor node and the at least one server node are configured to communicate with at least one remote node from the plurality of remote nodes via one or more other intermediate remote nodes.
15. A system of claim 1, wherein at least one remote node is housed within a tamper resistant package with at least one detector.
16. A secure detection node comprising:
A. a secure network interface, configured to receive an agent module and node-specific configuration files via a secure network;
B. a processor and a memory, the processor configured to execute the agent module, the agent module configured to implement the node-specific configuration files to establish a different encryption means for each node from a set of nodes with which the secure detection node is to communicate;
C. a detector interface, configured to receive data from a set of detectors disposed to detect the presence of an illegal condition within a shipping container; and
D. orthogonal authentication means for selectively restricting access to at least one of the plurality of remote nodes.
17. The node of claim 16, further comprising:
E. a tamper resistant box within which the processor and memory are housed.
18. The node of claim 16, further comprising:
E. at least one detector from the set of detectors.
19. The node of claim 18, further comprising:
F. a tamper resistant box within which the processor, memory and at least one detector are housed.
20. A method of providing a secure detection network system having a plurality of nodes, each node comprising a processor and storage means, the method comprising:
A. providing a plurality of remote nodes, each remote node comprising a set of detector interfaces configured for coupling to a set of detectors disposed for detecting the presence of an illegal condition within a shipping container;
B. generating by at least one server node an intelligent agent module and a set of node specific configuration files for each remote node in the plurality of remote nodes, including defining for each remote node a set of other nodes with which the remote node can communicate, including providing a different encryption means corresponding to each node in the set other nodes;
C. downloading to each remote node via a communication path a corresponding intelligent agent module and a corresponding set of node specific configuration files;
D. installing each remote node in the plurality of remote nodes, including executing the corresponding intelligent agent module with the corresponding node specific configuration files; and
E. selectively restricting access to at least one of the plurality of remote nodes by at least one orthogonal authentication.
21. The method of claim 20 further including strobing the encryption means among the plurality of remote nodes.
22. The method of claim 20 further including providing for at least some of the plurality of remote nodes a wireless communication means, the communication path including an air path.
23. The method of claim 20 further including providing a wireless communication means for at least one monitor node, the communication path including an air path.
24. The method of claim 20 including selectively causing one or more of the plurality of remote nodes to terminate communication with at least one node in response to one or more termination events.
25. The method of claim 24, wherein the one or more termination events includes detecting tampering with one or more remote nodes.
26. The method of claim 20, wherein the illegal condition includes the presence of one or more suspicious materials, including chemical weapons, biological weapons, nuclear weapons, chemical agents, biological agents, radioactive materials, illegal drugs, explosive materials or devices, or shielding means.
27. The method of claim 20, wherein the illegal condition includes a suspicious activity, including an attempt to defeat a remote node or detector.
28. The method of claim 20, including installing one or more remote nodes from the plurality of remote nodes within a tamper resistant housing coupled to a shipping container.
29. The method of claim 20, including forming one or more subnetworks comprising a set of remotes nodes from the plurality of remote nodes, and wherein each subnetwork provides a portion of the communication path.
30. The method of claim 20, further comprising:
F. monitoring the plurality of remote nodes with at least one monitor node, including querying each of the plurality of remote nodes via the communication path.
31. The method of claim 30, wherein the at least one monitor nodes is a portable robot node.
32. The method of claim 30, including communicating between at least one remote node from the plurality of remote nodes and the at least one monitor node or the at least one server node via one or more other intermediate remote nodes.
33. The system of claim 1, wherein the orthogonal authentication means comprises a physical authentication.
34. The system of claim 33, wherein the physical authentication means is selected from the group consisting of: biometrics, physical facilities, human audit, telephones, hand geometry scanner, fingerprint scanner, facial scanner, and voice print scanner.
US10/600,738 1999-11-16 2003-06-20 Secure detection network system Active 2025-02-05 US7475428B2 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US10/600,738 US7475428B2 (en) 2002-06-20 2003-06-20 Secure detection network system
US12/277,100 US7930761B2 (en) 1999-11-16 2008-11-24 Secure detection network system
US13/088,824 US8533855B2 (en) 1999-11-16 2011-04-18 Secure detection network system

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US39020502P 2002-06-20 2002-06-20
US39020402P 2002-06-20 2002-06-20
US10/600,738 US7475428B2 (en) 2002-06-20 2003-06-20 Secure detection network system

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US09/441,403 Continuation US6918038B1 (en) 1996-08-13 1999-11-16 System and method for installing an auditable secure network

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/277,100 Continuation US7930761B2 (en) 1999-11-16 2008-11-24 Secure detection network system

Publications (2)

Publication Number Publication Date
US20040073808A1 US20040073808A1 (en) 2004-04-15
US7475428B2 true US7475428B2 (en) 2009-01-06

Family

ID=30003145

Family Applications (3)

Application Number Title Priority Date Filing Date
US10/600,738 Active 2025-02-05 US7475428B2 (en) 1999-11-16 2003-06-20 Secure detection network system
US12/277,100 Expired - Fee Related US7930761B2 (en) 1999-11-16 2008-11-24 Secure detection network system
US13/088,824 Expired - Lifetime US8533855B2 (en) 1999-11-16 2011-04-18 Secure detection network system

Family Applications After (2)

Application Number Title Priority Date Filing Date
US12/277,100 Expired - Fee Related US7930761B2 (en) 1999-11-16 2008-11-24 Secure detection network system
US13/088,824 Expired - Lifetime US8533855B2 (en) 1999-11-16 2011-04-18 Secure detection network system

Country Status (3)

Country Link
US (3) US7475428B2 (en)
AU (1) AU2003269893A1 (en)
WO (1) WO2004001551A2 (en)

Cited By (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070140145A1 (en) * 2005-12-21 2007-06-21 Surender Kumar System, method and apparatus for authentication of nodes in an Ad Hoc network
US20090045947A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Emergent Information Pattern Driven Sensor Networks
US20090049376A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Intelligence Driven Icons and Cursors
US20090045909A1 (en) * 2007-08-13 2009-02-19 Miller Landon C G Water Friend or Foe System for Global Vessel Identification and Tracking
US20090045946A1 (en) * 2007-08-13 2009-02-19 Miller Landon C G Emergent Information Pattern Driven Sensor Networks
US20090045936A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Pattern Driven Effectuator System
US20090049088A1 (en) * 2007-08-13 2009-02-19 Miller Landon C G Emergent Information Database Management System
US20090045949A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Pattern Driven Effectuator System
US20090045948A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Emergent Information Database Management System
US20090045983A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Water Friend or Foe System for Global Vessel Identification and Tracking
US20090049401A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Intelligence Driven Icons and Cursors
US20090232032A1 (en) * 2007-01-17 2009-09-17 Verbal World, Inc. Methods and Apparatus for the Manipulation of Conferenced Data
US20090313187A1 (en) * 2008-06-16 2009-12-17 International Business Machines Corporation Data pattern generation, modification and management utilizing a semantic network-based graphical interface
US20090309712A1 (en) * 2008-06-16 2009-12-17 International Business Machines Corporation Pattern-driven communication architecture
US7756593B2 (en) 2007-08-14 2010-07-13 International Business Machines Corporation Anomaly anti-pattern
US8769373B2 (en) 2010-03-22 2014-07-01 Cleon L. Rogers, JR. Method of identifying and protecting the integrity of a set of source data
US20140201720A1 (en) * 2013-01-14 2014-07-17 Apple Inc. Branch auditing in a computer program
US8792464B2 (en) 2012-02-29 2014-07-29 Harris Corporation Communication network for detecting uncooperative communications device and related methods
US9052403B2 (en) 2002-07-23 2015-06-09 Rapiscan Systems, Inc. Compact mobile cargo scanning system
US9218933B2 (en) 2011-06-09 2015-12-22 Rapidscan Systems, Inc. Low-dose radiographic imaging system
US9223050B2 (en) 2005-04-15 2015-12-29 Rapiscan Systems, Inc. X-ray imaging system having improved mobility
US9223049B2 (en) 2002-07-23 2015-12-29 Rapiscan Systems, Inc. Cargo scanning system with boom structure
US9285498B2 (en) 2003-06-20 2016-03-15 Rapiscan Systems, Inc. Relocatable X-ray imaging system and method for inspecting commercial vehicles and cargo containers
US9332624B2 (en) 2008-05-20 2016-05-03 Rapiscan Systems, Inc. Gantry scanner systems
US9429530B2 (en) 2008-02-28 2016-08-30 Rapiscan Systems, Inc. Scanning systems
US9791590B2 (en) 2013-01-31 2017-10-17 Rapiscan Systems, Inc. Portable security inspection system
US10257250B2 (en) * 2012-08-06 2019-04-09 Canon Kabushiki Kaisha Management system, server, client, and method thereof

Families Citing this family (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1246094A1 (en) * 2001-03-27 2002-10-02 TELEFONAKTIEBOLAGET L M ERICSSON (publ) Container surveillance system and related method
US7479877B2 (en) * 2002-09-17 2009-01-20 Commerceguard Ab Method and system for utilizing multiple sensors for monitoring container security, contents and condition
TW200417848A (en) * 2002-09-17 2004-09-16 Allset Tracking Ab Method and system for monitoring containers to maintain the security thereof
US20080221793A1 (en) * 2003-01-24 2008-09-11 Shotspotteer, Inc. Systems and methods of tracking and/or avoiding harm to certain devices or humans
WO2004077091A1 (en) * 2003-02-25 2004-09-10 All Set Marine Security Ab Method and system for monitoring relative movement of maritime containers and other cargo
US6998617B2 (en) * 2003-06-11 2006-02-14 Cargo Sentry, Inc. Apparatus and method for detecting weapons of mass destruction
US7098784B2 (en) * 2003-09-03 2006-08-29 System Planning Corporation System and method for providing container security
US7079976B2 (en) * 2003-10-07 2006-07-18 The Johns Hopkins University Dense object detection system and method
JP4663650B2 (en) * 2003-11-13 2011-04-06 コマースガード アーベー Method and system for monitoring containers and maintaining container safety
JP4046698B2 (en) * 2004-02-04 2008-02-13 シャープ株式会社 Data providing system and data providing apparatus
WO2005091237A1 (en) * 2004-03-24 2005-09-29 All Set Marine Security Ab Method and system for monitoring containers to maintain the security thereof
ATE411581T1 (en) * 2004-04-07 2008-10-15 All Set Marine Security Ab METHOD AND SYSTEMS FOR ARMING A CONTAINER SECURITY DEVICE WITHOUT USING AN ELECTRONIC READER
US7324921B2 (en) * 2004-12-28 2008-01-29 Rftrax Inc. Container inspection system
US7378962B2 (en) * 2004-12-30 2008-05-27 Sap Aktiengesellschaft Sensor node management and method for monitoring a seal condition of an enclosure
WO2007055720A2 (en) * 2005-03-28 2007-05-18 United Technologies Corporation Vehicle-based threat detection system
US7283052B2 (en) 2005-05-13 2007-10-16 Commerceguard Ab Method and system for arming a multi-layered security system
US7351982B2 (en) * 2005-05-24 2008-04-01 Washington Savannah River Company Llp Portable nuclear material detector and process
US8225312B2 (en) * 2005-08-12 2012-07-17 Sony Corporation Method and apparatus for downloading software updates
US20080104410A1 (en) * 2006-10-25 2008-05-01 Brown Daniel R Electronic clinical system having two-factor user authentication prior to controlled action and method of use
GB0803644D0 (en) 2008-02-28 2008-04-02 Rapiscan Security Products Inc Scanning systems
ITRM20080191A1 (en) * 2008-04-10 2009-10-11 Enea Ente Per Le Nuove Tecnologie, L Energia E... MULTI-TERMINAL RADIOMETRIC MOBILE FOR NETWORK GEOGRAPHICALLY DISTRIBUTED OPERATING IN REAL TIME
US20120070002A1 (en) * 2009-07-19 2012-03-22 Angel Secure Networks, Inc. Protecting information in an untethered asset
CN102483789B (en) * 2009-08-28 2015-07-01 沃尔沃拉斯特瓦格纳公司 Tampering detection method
US20110200193A1 (en) * 2010-02-12 2011-08-18 Daniel Ray Blitz Method and apparatus for controlling the recharging of electric vehicles and detecting stolen vehicles and vehicular components
US20120227091A1 (en) * 2011-03-01 2012-09-06 Angel Secure Networks, Inc. Polymorphic assured network
US9294283B2 (en) * 2011-08-31 2016-03-22 Q-Tag Ag Methods and devices for monitoring the integrity of an article during transporting said article
US9116888B1 (en) * 2012-09-28 2015-08-25 Emc Corporation Customer controlled data privacy protection in public cloud
US9584313B2 (en) 2013-08-09 2017-02-28 Introspective Power, Inc. Streaming one time pad cipher using rotating ports for data encryption
US9584488B2 (en) 2013-08-09 2017-02-28 Introspective Power, Inc. Data encryption cipher using rotating ports
US10482418B2 (en) 2016-09-28 2019-11-19 Federal Express Corporation Systems and methods for inspecting a delivery vehicle using a paired inspection drone
US10969467B1 (en) 2018-04-13 2021-04-06 Kwesst Inc. Programmable multi-waveform RF generator for use as battlefield decoy
US11096243B2 (en) 2018-04-13 2021-08-17 Kwesst Inc. Programmable multi-waveform RF generator for use as battlefield decoy

Citations (47)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4408203A (en) 1978-01-09 1983-10-04 Mastercard International, Inc. Security system for electronic funds transfer system
US4658093A (en) 1983-07-11 1987-04-14 Hellman Martin E Software distribution system
US4696003A (en) 1986-03-10 1987-09-22 International Business Machines Corporation System for testing interactive software
US4731880A (en) 1983-05-12 1988-03-15 American Telephone And Telegraph Company, At&T Bell Laboratories Communication network
US4809362A (en) 1987-03-13 1989-02-28 Center For Innovative Technology Fiber-optic star tree network
US4962498A (en) 1989-06-23 1990-10-09 At & T Bell Laboratories Multi-length packet format including check sequence(s)
US4999806A (en) 1987-09-04 1991-03-12 Fred Chernow Software distribution system
US5001755A (en) 1988-04-19 1991-03-19 Vindicator Corporation Security system network
US5005122A (en) 1987-09-08 1991-04-02 Digital Equipment Corporation Arrangement with cooperating management server node and network service node
US5023907A (en) 1988-09-30 1991-06-11 Apollo Computer, Inc. Network license server
US5155847A (en) 1988-08-03 1992-10-13 Minicom Data Corporation Method and apparatus for updating software at remote locations
US5247683A (en) 1990-06-28 1993-09-21 International Business Machines Corporation System and method for installing software and updating configuration files
US5301247A (en) 1992-07-23 1994-04-05 Crest Industries, Inc. Method for ensuring secure communications
US5317744A (en) 1991-11-15 1994-05-31 The United States Of America As Represented By The Secretary Of The Air Force Method for configuring a computer server to operate with network operating system software to prevent memory address conflicts between workstations
US5388211A (en) 1989-04-28 1995-02-07 Softel, Inc. Method and apparatus for remotely controlling and monitoring the use of computer software
US5416842A (en) 1994-06-10 1995-05-16 Sun Microsystems, Inc. Method and apparatus for key-management scheme for use with internet protocols at site firewalls
US5421009A (en) 1993-12-22 1995-05-30 Hewlett-Packard Company Method of remotely installing software directly from a central computer
US5438508A (en) 1991-06-28 1995-08-01 Digital Equipment Corporation License document interchange format for license management system
US5452415A (en) 1992-03-26 1995-09-19 Alcatel Network Systems, Inc. Method and system for automatically displaying and configuring a network monitoring system
US5495610A (en) 1989-11-30 1996-02-27 Seer Technologies, Inc. Software distribution system to build and distribute a software release
EP0703531A1 (en) 1994-09-08 1996-03-27 Compaq Computer Corporation Software updating method
US5509074A (en) 1994-01-27 1996-04-16 At&T Corp. Method of protecting electronically published materials using cryptographic protocols
US5509070A (en) 1992-12-15 1996-04-16 Softlock Services Inc. Method for encouraging purchase of executable and non-executable software
US5548649A (en) 1995-03-28 1996-08-20 Iowa State University Research Foundation Network security bridge and associated method
US5594866A (en) 1989-01-18 1997-01-14 Intel Corporation Message routing in a multi-processor computer system with alternate edge strobe regeneration
US5638512A (en) 1992-10-20 1997-06-10 Xlnt Designs, Inc. Ring network security system with encoding of data entering a subnetwork and decoding of data leaving the subnet work
EP0778512A2 (en) 1995-12-08 1997-06-11 Sun Microsystems, Inc. System and method for managing try-and-buy usage of application programs
US5642394A (en) * 1996-04-03 1997-06-24 American Science And Engineering, Inc. Sidescatter X-ray detection system
US5671279A (en) 1995-11-13 1997-09-23 Netscape Communications Corporation Electronic commerce using a secure courier system
US5706507A (en) 1995-07-05 1998-01-06 International Business Machines Corporation System and method for controlling access to data located on a content server
US5708780A (en) 1995-06-07 1998-01-13 Open Market, Inc. Internet server access control and monitoring systems
US5710883A (en) 1995-03-10 1998-01-20 Stanford University Hypertext document transport mechanism for firewall-compatible distributed world-wide web publishing
US5721783A (en) 1995-06-07 1998-02-24 Anderson; James C. Hearing aid with wireless remote processor
US5732275A (en) 1996-01-11 1998-03-24 Apple Computer, Inc. Method and apparatus for managing and automatically updating software programs
US5737706A (en) 1995-08-03 1998-04-07 Bell Atlantic Network Services, Inc. Power system supporting CDPD operation
US5748896A (en) 1995-12-27 1998-05-05 Apple Computer, Inc. Remote network administration methods and apparatus
US5826014A (en) 1996-02-06 1998-10-20 Network Engineering Software Firewall system for protecting network elements connected to a public network
US5864747A (en) 1995-08-24 1999-01-26 General Dynamics Information Systems, Inc. Data bridge
US5909589A (en) 1996-11-12 1999-06-01 Lance T. Parker Internet based training
US5974250A (en) 1996-12-13 1999-10-26 Compaq Computer Corp. System and method for secure information transmission over a network
US6067619A (en) 1998-09-24 2000-05-23 Hewlett-Packard Company Apparatus and method for configuring a computer networking device
US6067582A (en) 1996-08-13 2000-05-23 Angel Secure Networks, Inc. System for installing information related to a software application to a remote computer over a network
US6119186A (en) 1997-05-30 2000-09-12 Texas Instruments Incorporated Computer system with environmental manager for detecting and responding to changing environmental conditions
US6523166B1 (en) * 1998-09-21 2003-02-18 Microsoft Corporation Method and system for on-demand installation of software implementations
US6535254B1 (en) 1997-10-31 2003-03-18 Pinnacle Systems Inc. Method and device for noise reduction
US20030126464A1 (en) * 2001-12-04 2003-07-03 Mcdaniel Patrick D. Method and system for determining and enforcing security policy in a communication session
US6918038B1 (en) 1996-08-13 2005-07-12 Angel Secure Networks, Inc. System and method for installing an auditable secure network

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6038666A (en) * 1997-12-22 2000-03-14 Trw Inc. Remote identity verification technique using a personal identification device

Patent Citations (48)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4408203A (en) 1978-01-09 1983-10-04 Mastercard International, Inc. Security system for electronic funds transfer system
US4731880A (en) 1983-05-12 1988-03-15 American Telephone And Telegraph Company, At&T Bell Laboratories Communication network
US4658093A (en) 1983-07-11 1987-04-14 Hellman Martin E Software distribution system
US4696003A (en) 1986-03-10 1987-09-22 International Business Machines Corporation System for testing interactive software
US4809362A (en) 1987-03-13 1989-02-28 Center For Innovative Technology Fiber-optic star tree network
US4999806A (en) 1987-09-04 1991-03-12 Fred Chernow Software distribution system
US5005122A (en) 1987-09-08 1991-04-02 Digital Equipment Corporation Arrangement with cooperating management server node and network service node
US5001755A (en) 1988-04-19 1991-03-19 Vindicator Corporation Security system network
US5155847A (en) 1988-08-03 1992-10-13 Minicom Data Corporation Method and apparatus for updating software at remote locations
US5023907A (en) 1988-09-30 1991-06-11 Apollo Computer, Inc. Network license server
US5594866A (en) 1989-01-18 1997-01-14 Intel Corporation Message routing in a multi-processor computer system with alternate edge strobe regeneration
US5388211A (en) 1989-04-28 1995-02-07 Softel, Inc. Method and apparatus for remotely controlling and monitoring the use of computer software
US4962498A (en) 1989-06-23 1990-10-09 At & T Bell Laboratories Multi-length packet format including check sequence(s)
US5495610A (en) 1989-11-30 1996-02-27 Seer Technologies, Inc. Software distribution system to build and distribute a software release
US5247683A (en) 1990-06-28 1993-09-21 International Business Machines Corporation System and method for installing software and updating configuration files
US5438508A (en) 1991-06-28 1995-08-01 Digital Equipment Corporation License document interchange format for license management system
US5317744A (en) 1991-11-15 1994-05-31 The United States Of America As Represented By The Secretary Of The Air Force Method for configuring a computer server to operate with network operating system software to prevent memory address conflicts between workstations
US5452415A (en) 1992-03-26 1995-09-19 Alcatel Network Systems, Inc. Method and system for automatically displaying and configuring a network monitoring system
US5301247A (en) 1992-07-23 1994-04-05 Crest Industries, Inc. Method for ensuring secure communications
US5638512A (en) 1992-10-20 1997-06-10 Xlnt Designs, Inc. Ring network security system with encoding of data entering a subnetwork and decoding of data leaving the subnet work
US5509070A (en) 1992-12-15 1996-04-16 Softlock Services Inc. Method for encouraging purchase of executable and non-executable software
US5421009A (en) 1993-12-22 1995-05-30 Hewlett-Packard Company Method of remotely installing software directly from a central computer
US5509074A (en) 1994-01-27 1996-04-16 At&T Corp. Method of protecting electronically published materials using cryptographic protocols
US5416842A (en) 1994-06-10 1995-05-16 Sun Microsystems, Inc. Method and apparatus for key-management scheme for use with internet protocols at site firewalls
EP0703531A1 (en) 1994-09-08 1996-03-27 Compaq Computer Corporation Software updating method
US5710883A (en) 1995-03-10 1998-01-20 Stanford University Hypertext document transport mechanism for firewall-compatible distributed world-wide web publishing
US5548649A (en) 1995-03-28 1996-08-20 Iowa State University Research Foundation Network security bridge and associated method
US5721783A (en) 1995-06-07 1998-02-24 Anderson; James C. Hearing aid with wireless remote processor
US5708780A (en) 1995-06-07 1998-01-13 Open Market, Inc. Internet server access control and monitoring systems
US5706507A (en) 1995-07-05 1998-01-06 International Business Machines Corporation System and method for controlling access to data located on a content server
US5737706A (en) 1995-08-03 1998-04-07 Bell Atlantic Network Services, Inc. Power system supporting CDPD operation
US5864747A (en) 1995-08-24 1999-01-26 General Dynamics Information Systems, Inc. Data bridge
US5671279A (en) 1995-11-13 1997-09-23 Netscape Communications Corporation Electronic commerce using a secure courier system
EP0778512A2 (en) 1995-12-08 1997-06-11 Sun Microsystems, Inc. System and method for managing try-and-buy usage of application programs
US5708709A (en) 1995-12-08 1998-01-13 Sun Microsystems, Inc. System and method for managing try-and-buy usage of application programs
US5748896A (en) 1995-12-27 1998-05-05 Apple Computer, Inc. Remote network administration methods and apparatus
US5732275A (en) 1996-01-11 1998-03-24 Apple Computer, Inc. Method and apparatus for managing and automatically updating software programs
US5826014A (en) 1996-02-06 1998-10-20 Network Engineering Software Firewall system for protecting network elements connected to a public network
US5642394A (en) * 1996-04-03 1997-06-24 American Science And Engineering, Inc. Sidescatter X-ray detection system
US6067582A (en) 1996-08-13 2000-05-23 Angel Secure Networks, Inc. System for installing information related to a software application to a remote computer over a network
US6918038B1 (en) 1996-08-13 2005-07-12 Angel Secure Networks, Inc. System and method for installing an auditable secure network
US5909589A (en) 1996-11-12 1999-06-01 Lance T. Parker Internet based training
US5974250A (en) 1996-12-13 1999-10-26 Compaq Computer Corp. System and method for secure information transmission over a network
US6119186A (en) 1997-05-30 2000-09-12 Texas Instruments Incorporated Computer system with environmental manager for detecting and responding to changing environmental conditions
US6535254B1 (en) 1997-10-31 2003-03-18 Pinnacle Systems Inc. Method and device for noise reduction
US6523166B1 (en) * 1998-09-21 2003-02-18 Microsoft Corporation Method and system for on-demand installation of software implementations
US6067619A (en) 1998-09-24 2000-05-23 Hewlett-Packard Company Apparatus and method for configuring a computer networking device
US20030126464A1 (en) * 2001-12-04 2003-07-03 Mcdaniel Patrick D. Method and system for determining and enforcing security policy in a communication session

Non-Patent Citations (40)

* Cited by examiner, † Cited by third party
Title
Adam Bryant, Am I Bid Six? Click to Bid Six!, The New York Times, May 13, 1996, Section D1.
Brian D. Noble, Morgan Price and M. Satyanarayanan, A Programming Interface for Application-Aware Adaptation in Mobile Computing, Fall 1995, USENIX Association, vol. 8, No. 4, pp. 345-363.
C. Anthony DellaFera et al., the Zephyr Notification Service, USENIX Winter Conference, Feb. 9-12, 1988.
Carol Sliwa, Netscape Unveils New 'New Commerce Offerings', Networld World, May 13, 1996, Section: Internet News, p. 10.
Chii-Ren Tsai et al., Distributed Audit with Secure Remote Procedure Calls, Oct. 1991, pp. 154-160, XP000300426.
Chris Jones, Licensing Plan Flows from Stream, Infoworld, May 6, 1996, Section: News.
Chris Maeda and Brian N. Bershad, Service without Servers, Aug. 1, 1993, IEEE, 4th IEEE Workshop on Workstation Operating Systems, pp. 170-176.
Daniel J. Bernstein, Let's Talk: Interapplication Communications in C++ Using X Properties, Jan.-Feb. 1996, The X Journal, pp. 37-44.
Daniel Nachbar, When Network File Systems Aren't Enough: Automatic Software Distribution Revisited, Summer 1986, USENIX Tech. Conf., pp. 159-171.
David M. Arnow, DP: A Library for Building Portable, Reliable Distributed Applications, Jan. 16-20, 1995, USENIX Tech Conf, pp. 235-247.
Diane Trommer, ECS Catalog Merges EDI/Net Platforms, Electronic Buyers News, May 20, 1996, Section: Purchasing, p. 54.
Diane Trommer, GE/Netscape Form Software Venture, Electronic Buyers News, Apr. 22, 1996, Section: Online @EBN, p. 54.
Ellen Messmer, Active X Pioneer Pushes Commerce, Network World, May 6, 1996, p. 33.
Ellen Messmer, Edify Software to Let Banks Open Doors Online, May 20, 1996, Network World, p. 16.
Ellen Messmer, Start-up puts security Socks on Windows apps, May 20, 1996, Network World, p. 16.
Hogg, A Photometricity and Extinction Monitor At The Apache Point Observatory, 2001 The Astronomical Journal, pp. 2129-2138. *
International Search Report, PCT/US03/19799 dated Mar. 25, 2004.
Jan Ozer, Online Software Stores, PC Magazine, May 28, 1996, Section: Trends, p. 36.
Joanie Wexler, AT&T Sells Insurers on the Web, May 20, 1996, Network World, p. 27.
Karen Rodriguez, Pushing the Envelope, Communications Week, May 31, 1996, Section: Internet/Internet, p. 37.
Ken Yamada and Barbara Darrow, Electronic Distribution Program on tap, Apr. 29, 1996, Computer Reseller News, pp. 1 and 169.
Kim S. Nash and Lisa Picarille, Vendors Deliver IS-specific Apps Over the 'Net', Computer World, May 6, 1996, Section: News, p. 16.
Lian, Time Delay Modeling and Sample Time Selection For Networked Control Systems, 2001, Proceedings of ASME-DSC, vol. XX, pp. 1-8. *
Margie Semilof, Boosting Web Business, Communications Week, May 20, 1996, Section: News Brief, p. 31.
Martin Marshall, Banking on the Internet, Communications Week, May 20, 1996, p. 1.
Michael B. Jones, Interposition Agents: Transparently Interposing User Code at the System Interface, 1993, 14th ACM Symposium on Operating Systems Principals, pp. 80-93.
Michael Baentsch, Georg Molter and Peter Sturm, WebMake: Integrating Distributed Software Development in a Structure-enhanced Web, 1995, Computer Networks and ISDN Systems 27, pp. 789-800.
Michel Dagenais, Stephane Boucher, Robert Gerin-Lajoie, Pierre Laplante, Pierre Mailhot, LUDE: A Distributed Software Library, Nov. 1-5, 1993, USENIX Tech Conf, pp. 25-32.
Murray Turnoff and Sanjit Chinai, An Electronic Information Marketplace, 1985, North Holland Computer Networks and ISDN Systems 9, pp. 79-90.
One Click Software Via the Web, Datamation, May 1, 1995, p. 16.
Sebastian Rupley, Digital Bucks? Stop Here, PC Magazine, May 28, 1996, Section: First Looks, p. 54.
Set Tool Kit for Secure Commerce, Bank Systems + Technology, May 1996, p. 16.
Software Taps Net for Supply Data Sharing, Electronic Buyers News, Apr. 22, 1996, Section: Purchasing, p. 50.
Steven W. Lodin, The Corporate Software Bank, Nov. 1-5, 1993, USENIX Tech Conf, pp. 33-42.
Stream International Inc., Stream, LitleNet, BBN, and KPMG Announce Industry-Wide Initiative to Enable Wide-Scale Software Electronic Commerce, May 12, 1996, http://www.stream.com.
Takahata M. et al., Real-Time Video-On-Demand System based on Distributed Servers and An Agent-Oriented Application, vol. 2663, Jan. 31, 1996, pp. 242-251.
Thomas Eirich, Beam: A Tool for Flexible Software Update, Sep. 19-23, 1994, USENIX Tech Conf, pp. 75-82.
Tim Clark, The Big Sell, Software Online, Apr. 22, 1996, Inter@ctive Week, pp. 31-35.
Udo Flohr, Electric Money, Jun. 1996, Byte, pp. 74-84.
Walter C. Wong, Local Disk Depot-Customizing the Software Environment, Nov. 1-5, 1993, USENIX Tech Conf, pp. 51-55.

Cited By (44)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10670769B2 (en) 2002-07-23 2020-06-02 Rapiscan Systems, Inc. Compact mobile cargo scanning system
US10007019B2 (en) 2002-07-23 2018-06-26 Rapiscan Systems, Inc. Compact mobile cargo scanning system
US9223049B2 (en) 2002-07-23 2015-12-29 Rapiscan Systems, Inc. Cargo scanning system with boom structure
US9052403B2 (en) 2002-07-23 2015-06-09 Rapiscan Systems, Inc. Compact mobile cargo scanning system
US9285498B2 (en) 2003-06-20 2016-03-15 Rapiscan Systems, Inc. Relocatable X-ray imaging system and method for inspecting commercial vehicles and cargo containers
US9223050B2 (en) 2005-04-15 2015-12-29 Rapiscan Systems, Inc. X-ray imaging system having improved mobility
US20070140145A1 (en) * 2005-12-21 2007-06-21 Surender Kumar System, method and apparatus for authentication of nodes in an Ad Hoc network
US20090232032A1 (en) * 2007-01-17 2009-09-17 Verbal World, Inc. Methods and Apparatus for the Manipulation of Conferenced Data
US9076314B2 (en) 2007-08-13 2015-07-07 International Business Machines Corporation Emergent information pattern driven sensor networks
US20090049088A1 (en) * 2007-08-13 2009-02-19 Miller Landon C G Emergent Information Database Management System
US20090045946A1 (en) * 2007-08-13 2009-02-19 Miller Landon C G Emergent Information Pattern Driven Sensor Networks
US20090045909A1 (en) * 2007-08-13 2009-02-19 Miller Landon C G Water Friend or Foe System for Global Vessel Identification and Tracking
US8712987B2 (en) 2007-08-13 2014-04-29 International Business Machines Corporation Emergent information database management system
US7979088B2 (en) 2007-08-13 2011-07-12 International Business Machines Corporation Water friend or foe system for global vessel identification and tracking
US7756593B2 (en) 2007-08-14 2010-07-13 International Business Machines Corporation Anomaly anti-pattern
US20090049376A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Intelligence Driven Icons and Cursors
US7710258B2 (en) * 2007-08-14 2010-05-04 International Business Machines Corporation Emergent information pattern driven sensor networks
US7710257B2 (en) * 2007-08-14 2010-05-04 International Business Machines Corporation Pattern driven effectuator system
US7710259B2 (en) * 2007-08-14 2010-05-04 International Business Machines Corporation Emergent information database management system
US7823082B2 (en) 2007-08-14 2010-10-26 International Business Machines Corporation Intelligence driven icons and cursors
US7889100B2 (en) 2007-08-14 2011-02-15 International Business Machines Corporation Water friend or foe system for global vessel identification and tracking
US7710260B2 (en) * 2007-08-14 2010-05-04 International Business Machines Corporation Pattern driven effectuator system
US7992094B2 (en) 2007-08-14 2011-08-02 International Business Machines Corporation Intelligence driven icons and cursors
US20090045983A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Water Friend or Foe System for Global Vessel Identification and Tracking
US20090045947A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Emergent Information Pattern Driven Sensor Networks
US20090045948A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Emergent Information Database Management System
US20090045949A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Pattern Driven Effectuator System
US20090049401A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Intelligence Driven Icons and Cursors
US20090045936A1 (en) * 2007-08-14 2009-02-19 Miller Landon C G Pattern Driven Effectuator System
US9429530B2 (en) 2008-02-28 2016-08-30 Rapiscan Systems, Inc. Scanning systems
US9332624B2 (en) 2008-05-20 2016-05-03 Rapiscan Systems, Inc. Gantry scanner systems
US10098214B2 (en) 2008-05-20 2018-10-09 Rapiscan Systems, Inc. Detector support structures for gantry scanner systems
US20090313187A1 (en) * 2008-06-16 2009-12-17 International Business Machines Corporation Data pattern generation, modification and management utilizing a semantic network-based graphical interface
US8086547B2 (en) 2008-06-16 2011-12-27 International Business Machines Corporation Data pattern generation, modification and management utilizing a semantic network-based graphical interface
US20090309712A1 (en) * 2008-06-16 2009-12-17 International Business Machines Corporation Pattern-driven communication architecture
US8769373B2 (en) 2010-03-22 2014-07-01 Cleon L. Rogers, JR. Method of identifying and protecting the integrity of a set of source data
US9218933B2 (en) 2011-06-09 2015-12-22 Rapidscan Systems, Inc. Low-dose radiographic imaging system
US8792464B2 (en) 2012-02-29 2014-07-29 Harris Corporation Communication network for detecting uncooperative communications device and related methods
US10257250B2 (en) * 2012-08-06 2019-04-09 Canon Kabushiki Kaisha Management system, server, client, and method thereof
US20140201720A1 (en) * 2013-01-14 2014-07-17 Apple Inc. Branch auditing in a computer program
US9047448B2 (en) * 2013-01-14 2015-06-02 Apple Inc. Branch auditing in a computer program
US9791590B2 (en) 2013-01-31 2017-10-17 Rapiscan Systems, Inc. Portable security inspection system
US10317566B2 (en) 2013-01-31 2019-06-11 Rapiscan Systems, Inc. Portable security inspection system
US11550077B2 (en) 2013-01-31 2023-01-10 Rapiscan Systems, Inc. Portable vehicle inspection portal with accompanying workstation

Also Published As

Publication number Publication date
WO2004001551A3 (en) 2004-06-24
AU2003269893A1 (en) 2004-01-06
US20040073808A1 (en) 2004-04-15
WO2004001551A2 (en) 2003-12-31
US7930761B2 (en) 2011-04-19
US20090083842A1 (en) 2009-03-26
US20120005730A1 (en) 2012-01-05
AU2003269893A8 (en) 2004-01-06
US8533855B2 (en) 2013-09-10

Similar Documents

Publication Publication Date Title
US7475428B2 (en) Secure detection network system
US20120070002A1 (en) Protecting information in an untethered asset
Cooper et al. Computer and communications security
US10193695B1 (en) Methods and systems for automatic object recognition and authentication
Razzaq et al. Security issues in the Internet of Things (IoT): A comprehensive study
US11171974B2 (en) Distributed agent based model for security monitoring and response
Ramadan et al. Cybersecurity and Countermeasures at the Time of Pandemic
US20060101047A1 (en) Method and system for fortifying software
US10650139B2 (en) Securing temporal digital communications via authentication and validation for wireless user and access devices with securitized containers
US20080172713A1 (en) Network Security Enforcement System
Jain et al. Internet of things: Architecture, security goals, and challenges—A survey
Gupta et al. Security and privacy issues in Blockchained IoT: Principles, Challenges and counteracting actions
US7263588B1 (en) Data storage system using geographically-distributed storage devices/facilities
Shrivastava et al. Preventing data tampering in IoT networks
Maurya et al. Security aspects of the internet of drones (IoD)
Kaur et al. Exploring the Potential of Blockchain Technology in Enhancing Security of smart systems
Singh et al. Security and privacy aspect of cyber physical systems
Alsmadi et al. IoT security threats analysis based on components, layers and devices
Denning Crime and crypto on the information superhighway
US11184367B2 (en) Applying blockchain to a sensor tracker
WO2019133326A1 (en) Securing temporal digital communications
Choi et al. Trustworthy design architecture: Cyber-physical system
Arya et al. Privacy and Security of Data in IoT: Design Principles and Techniques
CN105912945A (en) Safety reinforcing device and operation method of operating system
Mammeri Cryptography: Algorithms, Protocols, and Standards for Computer Security

Legal Events

Date Code Title Description
AS Assignment

Owner name: ANGEL SECURE NETWORKS, INC., MASSACHUSETTS

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SMITH, FRED HEWITT;SMITH, BENJAMIN HEWITT;SMITH, CYNTHIA;REEL/FRAME:016348/0737

Effective date: 20041127

FEPP Fee payment procedure

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

STCF Information on status: patent grant

Free format text: PATENTED CASE

CC Certificate of correction
FEPP Fee payment procedure

Free format text: PAYER NUMBER DE-ASSIGNED (ORIGINAL EVENT CODE: RMPN); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

CC Certificate of correction
FEPP Fee payment procedure

Free format text: PAYER NUMBER DE-ASSIGNED (ORIGINAL EVENT CODE: RMPN); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

FPAY Fee payment

Year of fee payment: 4

FPAY Fee payment

Year of fee payment: 8

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YR, SMALL ENTITY (ORIGINAL EVENT CODE: M2553); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

Year of fee payment: 12